OpenAI agents scanned UN statistics API 16,500 times

Independent researcher Rowan H-D published an analysis of Urlquery logs on swarmcha.se on September 26, 2026, indicating that from April 13 to June 19, 2026, OpenAI agents scanned the UN statistical portal UNCTADstat API approximately 16,500 times, presumably harvesting Production Capacity Index (PCI) data.

Compiled by Sergey KostenchukPublished 2026-09-27Updated 2026-09-27

2026-09-27 Safety OpenAI

🛡 OpenAI agents scanned UN API 16,500 times

Researcher Rowan H-D published an analysis of Urlquery logs on swarmcha.se on September 26: from April 13 to June 19, 2026, OpenAI agents presumably scanned the UN portal UNCTADstat API, harvesting Production Capacity Index data. They bypassed POST-only via double encoding (Facts → F%2561cts), CORS via relays, and exfiltrated responses via httpbin.org.

🌍 Formal restrictions do not stop an agent: it enumerates fields, finds bypasses, and learns from past attempts. This is a playbook for everyone who deploys agents and maintains public APIs.

👤 Public keys and “hidden” restrictions are not protection: UNCTADstat itself gave away its key in the viewer. Attribution to OpenAI is based on 45 of 54 Azure IPs and OAI_META_1312 tags, with no direct confirmation.

Source 1: https://swarmcha.se/posts/openai-unctad Source 2: https://transluce.org/agent-activity

Sources