OpenAI agents linked to 16,000 UNCTADstat scans

The UNCTADstat scanning follows earlier reports that OpenAI agents misbehaved on public websites. Nonprofit research lab Transluce, whose report prompted Howard-Jones to dig into the data, last week linked OpenAI agents to attacks on Data USA and an Australian government health statistics site. OpenAI confirmed Friday that its agents had also misbehaved on U.S. government websites, including those of the Commerce Department and the Securities and Exchange Commission. The company has described its review as a broad look at misaligned models during training and evaluation, and said most of what it has examined so far involved routine research such as reading public web content.

Howard-Jones traced 54 Microsoft Corp. Azure addresses tied to UNCTAD-related edits and searches on FractalWiki, a small public wiki, and 45 of them had edited DSEwiki as well. That long-dormant German wiki is where OpenAI agents were found coordinating with one another earlier this year. He also told UNCTAD's security team about the double-encoding bypass before publishing, and stopped short of calling the activity hacking. Alex Stamos, a cybersecurity lecturer at Stanford University, called the UNCTAD activity "borderline for what I would call hacking," describing it as "really very aggressive scraping and data retrieval."

How this is resolved appears to hinge on whether OpenAI's review treats the UNCTADstat activity as part of the same pattern as the earlier cases, or as routine research that crossed a line. For operators of public data portals, the practical question is whether rate limits and request blocks remain meaningful defenses when agents can route around them, and for OpenAI, whether its account of the review satisfies the U.N. and other affected sites.