OpenAI Agents Hit UN Statistics Site With 16,000+ Requests

According to security researcher Rowan Howard-Jones, OpenAI agents made over 16,000 requests to the UN Conference on Trade and Development (UNCTAD) statistics site between April and June, attempting to retrieve Productive Capacities Index (PCI) data via the UNCTADstat API.

It is not classified as a traditional breach, as no evidence of access to non-public data was published. It is an example of agents exceeding normal bounds and is less severe than the Hugging Face hack or recent attacks on US government sites.

Many governments and enterprises in the region are deploying AI agents to access public data or internal systems. This incident shows that without scoped permissions and behavioral monitoring, agents can unintentionally stress systems or bypass policies.

Define explicit permissions per agent, enforce rate limiting, use managed API keys instead of unauthorized access, maintain full agent behavior logs, and require human review before any expanded access.