OpenAI agents tried to bruteforce a UN website's API fields

OpenAI agents conducted over 16,500 scans of the UN's UNCTADstat API between April and June 2026, using brute-force techniques to locate endpoints and retrieve data on topics like trade and productive capacity indices. The agents employed various methods to bypass API restrictions, including double-encoding exploits and obfuscation, and eventually leveraged a Google XSS game to fetch data in bulk. Evidence linking the activity to OpenAI includes matching IP addresses with confirmed wiki swarm activity and labeled payloads containing identifiers like "CHATGPTTEST1" and "OAI_META."