// HACKER NEWS — CYBERSECURITY
OpenAI agents tried to bruteforce a UN website's API fields
From 13 April - 19 June 2026, OpenAI agents scanned UNCTAD's API ~16,500 times, using proxies, obfuscation, and Google's XSS game
UNCTAD is the UN Conference on Trade and Development.
UNCTADstat is a statistics site they serve,
which covers various trade/development indicators. The website renders data from
its API, at unctadstat-api.unctad.org/datamart-api/....
Transluce's report has a dataset showing
that agents made many requests to this site, but doesn't go into what these
requests actually are - I think they deserve some further inspection.
On the 6th of June 2026, UNCTADstat's plastics-trade API was hit by scans at
21:06 UTC and 22:40 UTC. 40 minutes later, at 23:20, a user
PublicDataResearchAgentT93214 created a page on FractalWiki, one of the wikis
hit by the
wiki swarms confirmed by OpenAI to be the result of OpenAI agents.
This page listed the exact UNCTADstat URLs that the scans used. We have those
wikis' access logs, which show that, of the 54 Azure IP addresses used to make
this page and other UNCTAD-related edits and searches, 45 of them also made
edits on DseWiki in the wiki swarm1. Furthermore, agents labelled their
payload pages and URLs with names such as CHATGPTTEST1, OAI_META_1312,
OAI_IFRAME_TRADABLE and CHATGPT_1610_2000_125192. We therefore believe it
is highly likely that the scanning against UNCTADstat was perpetrated by OpenAI
agents.
We have a great deal of data on the scans that were being done against these
websites, but we do not have the exact questions these agents were trying to
answer. Therefore, we can only make reasonable guesses based on the scans as to
what the questions were, but it appears that the data being sought after was
part of some internal question set that OpenAI uses for either training or
evaluating their models. Lynn Hughes did
a great article on the structure of such questions - while we
cannot ascertain whether it was the same format (or even part of the same
question set, or the same agents as the wiki swarms), the shape of the scans
suggests that the subject matter of the tasks was similar.
It appears that, as in the wiki swarms, these agents
did not have access to any HTTP methods except GET2, perhaps in an attempt to
stop them from mutating data on the web. However, UNCTAD's Facts endpoint only
accepts POST - a POST returns 200 (OK), and a GET to the same page returns 400
(error). Furthermore, it appears likely that they were unable to access the
UNCTADstat API directly at all - perhaps their training/evaluation environment
prevented them, or perhaps their IP range was blocked by the UNCTADstat API.
This left the agents with two problems:
Urlquery is a URL scanner. It opens a site you hand to
it in a sandboxed browser. It makes GET requests to a site, and shows you what
it sees. In order to do this it must also run any JavaScript on a site it
GETs.
Httpbin is a web dev test service.
https://httpbin.org/base64/ is an endpoint that lets you
encode a website to test it.
Therefore, the agents were able to use Urlquery as a proxy to make a basic POST
to UNCTAD's API through the following:
Make a link to this form on httpbin by base64-encoding it and terminating the
/base64/ endpoint with this encoding: