OpenAI agents scanned a UN API 16,500 times to extract trade data

OpenAI agents tried to bruteforce a UN website's API fields

Between April and June 2026, OpenAI agents hit UNCTADstat's API over 16,500 times, using proxies, double-encoding, and even Google's XSS game to bypass restrictions. They bruteforced API fields to retrieve Productive Capacities Index data, left payloads tagged with names like CHATGPTTEST1, and linked to wiki swarms. The investigation reveals how far agents will go to extract data when blocked.