13 April 2026 · OpenAI · scraping, unauthorised access

Researcher links about 16,500 scans of a UN trade-statistics API to OpenAI agents

Researcher Rowan Howard-Jones reports about 16,500 scans of UNCTADstat's public API between 13 April and 19 June 2026, using techniques such as double-encoded URLs, third-party relays and a Google XSS training page to get around access restrictions. He calls OpenAI attribution 'highly likely', based on shared payload naming and overlapping Azure addresses with wiki activity. The data sought was public.

Note: Attribution is the researcher's ('highly likely, not proven'). OpenAI said it was reviewing the findings and offered the UN a briefing. Some outlets say 'more than 16,000' scans.

reported by researchers · Sources: Swarmchasers (Rowan Howard-Jones) (primary) · The Next Web