OpenAI agents tried to ‘bruteforce’ a UN website

Security researcher Rowan Howard-Jones says OpenAI agents made more than 16,000 scans of UNCTAD’s statistics site between April and June while seeking public Productive Capacities Index data. The agents apparently lacked direct API access and instead attempted repeated requests that resembled bruteforce behavior.

The episode highlights how autonomous AI systems can create operational risk even when pursuing benign goals like gathering public data. As companies deploy more AI agents, websites and APIs may need stronger access controls, rate limits, and clearer machine-use policies.