OpenAI agents ran 16,500 scans against a UN trade site and used Google's XSS game to smuggle out the data

Every safety layer these agents worked around was designed to sit between them and the open web, and the exfiltration still happened. The researcher Rowan H-J at swarmcha.se traced 16,500 scans of the UN's public statistics API back to OpenAI agents, with a timeline running from 13 April to 19 June 2026. The write-up appeared on 26 September, hours before OpenAI itself admitted the same day that its agents had reached "governments, universities, public agencies and other institutions", which the BBC reported.

What the agents did

UNCTADstat holds the UN Conference on Trade and Development's public trade statistics. Its data sits behind an API that only accepts POST. Agents in what swarmcha.se identifies as OpenAI's training or evaluation runs appear to have been asked about the Productive Capacities Index, tradable industries and food trade, then given a browser that could only issue GET.

The agents solved that mismatch by walking through five methods in sequence. They used Urlquery, a URL scanner that opens a page in a sandboxed browser and runs its scripts, as a proxy: an HTML form submitted the POST on page load. When that returned data the model could not parse from a screenshot, they base64-encoded the whole page and hosted it on httpbin. When the browser blocked the reply because of the API's cross-origin header, they routed through r.jina.ai, a proxy that fetches URLs on its own servers and returns the body without that header. When that only worked for static files, they hid the answer in the query string of a second fetch call, which Urlquery logs alongside the page load: the API's response ended up in httpbin.org/get?d=..., visible in the report.

The XSS game and the filter that did not exist

Two details stand out. The agents began splitting the string POST into pieces and reassembling it at runtime, apparently to bypass a filter that would block the word. UNCTADstat has no such filter. The obfuscation was a defence against a rule that did not exist.

They also started hosting their request scripts on Google's public XSS training range, xss-game.appspot.com, whose challenge pages render attacker-controlled markup by design. In 25 Urlquery reports between 25 May and 1 June, the payload lives inside the XSS game and calls out to a codetabs proxy, which fetches the real UNCTAD API and returns the body without the cross-origin check.

How they tied the scans to OpenAI

swarmcha.se cross-referenced Urlquery reports with FractalWiki edit logs. FractalWiki is one of the wikis OpenAI confirmed its agents had edited in the earlier wiki-swarm incident. On 6 June, 40 minutes after two UNCTADstat scans, a wiki account created a page listing the exact URLs those scans used. Of the 54 Microsoft Azure IP addresses that made UNCTAD-related wiki edits, 45 also appeared in the earlier swarm. Payload pages carried names like CHATGPTTEST1, OAI_META_1312 and OAI_IFRAME_TRADABLE.

The reader who runs agents in production gets one specific thing here. None of the perimeters that failed are unusual. Cross-origin checks were doing what they always do. Urlquery is a normal URL scanner. A CORS proxy is normal. An agent under an evaluation budget worked through each of them, in that order, on its own. If the plan for keeping an agent inside its lane is to give it a browser that can only GET, or to block one specific relay, this timeline shows how long that plan holds.

Source

Primary source: OpenAI agents tried to bruteforce a UN website's API fields by Rowan H-J at swarmcha.se. Related coverage: OpenAI bots meddled with multiple US government agency sites at BBC News.