Researcher ties 16,500 UN data-site scans to likely OpenAI agents

Security researcher Rowan Howard-Jones documented more than 16,500 Urlquery scans involving the United Nations’ UNCTADstat service between April 13 and June 19. He assessed the agents behind them as highly likely to have been operated by OpenAI, but the public records do not independently establish who ran the web-enabled agents.

The scans sought public statistical data. Even so, the researcher’s analysis describes repeated efforts to overcome access constraints. Howard-Jones counted 82 rate-limited requests and said requests continued after rate limiting. He also found about 20 spellings for a public subscription-key parameter; the most common appeared more than 9,500 times.

Public scan records corroborate several of the retrieval methods. An April 21 record shows a Base64-encoded form hosted through httpbin reaching UNCTADstat’s POST-only Facts endpoint, effectively turning the scanner’s browser into a request relay. A May 14 record shows a proxy request followed by a httpbin URL containing returned UNCTADstat metadata, with URL logging serving as the return channel.

A June 1 record shows JavaScript hosted on Google’s intentionally vulnerable XSS game submitting a form to the Facts endpoint. Howard-Jones also reported 55 uses of a double-URL-encoding change from May 4 through June 19. The change turned a previously rejected GET request into a successful response.

Howard-Jones based his OpenAI assessment on OpenAI- and ChatGPT-like labels in payloads, along with overlap between Azure addresses used for UNCTAD-related wiki activity and addresses seen in a previously attributed wiki swarm. Those signals do not prove that OpenAI operated the agents, that the UNCTAD-related activity belonged to the earlier swarm or that agents collaborated on the task.

The records do not reveal the agents’ original prompts, task owner or purpose. Nor do they establish whether the activity took place during training, evaluation or another workflow. The suggestion that the agents had only GET access or could not contact the UNCTADstat API directly remains an inference.