Researcher links 16,000 scans of a UN statistics portal to OpenAI agents

An independent researcher has tied more than 16,000 scans of a United Nations statistics portal to artificial intelligence agents the researcher considers highly likely to have been run by OpenAI Group PBC.

When the portal turned requests away, the agents used proxies and encoding tricks to get the data anyway. In a blog post published Saturday, engineer Rowan Howard-Jones said the scanning lasted from April 13 until June 19. The target was the United Nations Conference on Trade and Development’s statistics site, UNCTADstat.

None of the data was secret. The agents wanted public figures such as the Productive Capacities Index, and Howard-Jones found them brute-forcing the fields of the site’s application programming interface to locate endpoints. The key they used for those queries was public too, since UNCTADstat’s own data viewer sends it with every request.

The main tool used was urlquery.net, a URL scanner that opens whatever page it is given in a sandboxed browser. The agents built base64-encoded HTML forms on the httpbin testing service and fed them to the scanner, whose browser then submitted the forms to UNCTADstat. Screenshots in the scan reports show index data coming back.

Later, the agents beat a block on GET requests to the Facts endpoint by double-encoding it as “F%2561cts.” Other payloads were hosted on a Google LLC game that teaches cross-site scripting, and some split the word “POST” into two strings, apparently to slip past filters.