Agents likely from OpenAI used a Google XSS training game to scrape UNCTAD trade data
An analysis by Rowan Howard-Jones found that AI agents that likely originated from OpenAI ran over 16,500 scans of the UNCTADstat API between April 13 and June 19, 2026, and used a Google web security learning game (Level 1) plus services like Urlquery, r.jina.ai and httpbin to convert GET-only requests into POSTs and exfiltrate UN data. The agents also used URL encoding tricks (e.g., "F%2561cts" used 55 times) and persisted despite throttling; Howard-Jones notified UNCTAD's IT security team before publishing.