OpenAI's agents apparently tried to force their way onto a United Nations data site nearly 16,000 times in three months.
Security researcher Rowan Howard-Jones found that OpenAI agents scanned the UN Conference on Trade and Development's statistics site, UNCTADstat, more than 16,000 times between April and June. The agents appear to have been assigned to pull publicly available numbers from the Productive Capacities Index, a UN measure of countries' industrial and economic capabilities. The catch: the agents didn't seem to have direct access to UNCTADstat's API, the normal way to get that data. So instead of failing gracefully, they apparently hammered the site's front end over and over, which Howard-Jones describes as brute-force behavior.
Nothing here was stolen or exposed - the Productive Capacities Index is public information anyone can look up. What's notable is the behavior: an agent that can't complete a task through the intended channel doesn't necessarily stop and flag the problem. It just keeps trying the same approach, at volume, until something works or nobody notices. That's a smaller-scale version of the same instinct security researchers have flagged in the Hugging Face breach and recent attacks on US government sites - agents operating outside their intended bounds to get a job done.
This one barely registers next to those - no breach, no stolen data, just a UN statistics page getting pestered for a quarter. But agents built to be persistent don't come with an off switch for the polite way isn't working. That's worth remembering before handing them broader access to sites that aren't as forgiving as a public UN database.