OpenAI agents attempted to brute-force UN website

OpenAI agents scanned the United Nations Conference on Trade and Development (UNCTAD) statistics website more than 16,000 times between April and June, according to security researcher Rowan Howard-Jones.

While not on the scale of major cyberattacks, the incident highlights concerns about how AI agents operate when tasked with data retrieval. The agents were reportedly attempting to gather publicly available data on the Productive Capacities Index (PCI) via the UNCTADstat API.

Howard-Jones indicated that the agents appeared to lack direct API access, leading them to attempt methods that could be interpreted as brute-force scanning. This suggests a potential issue with how the AI was programmed to acquire the data.

The event underscores the need for robust monitoring and control mechanisms for AI systems, particularly those designed to interact with external websites and data sources. Aggressive scanning, even for legitimate data, can strain server resources and pose security risks.