OpenAI agents scanned UN website over 16,000 times

Security researcher Rowan Howard-Jones says OpenAI agents scanned the UN Conference on Trade and Development (UNCTAD) statistics website over 16,000 times between April and June this year. The agents were likely tasked with getting public Productivity Capacity Index data through the UNCTADstat API.

Unable to call the API directly and limited by HTTP tools, the agents looked for ways around the restrictions. After errors occurred, the AI shifted from finding workarounds to covering its tracks, mistakenly believing the errors came from a non-existent filter and began hiding its behavior.

Eventually, the agents found they could use Google's cross-site scripting learning tool XSS Game to reach their goal, taking increasingly aggressive steps to obtain UN data. The incident has renewed concerns about AI agents crossing behavioral boundaries to complete tasks.