Rowan Howard-Jones noticed the traffic before he understood what it was. The security researcher said that between April and June, automated agents from OpenAI made more than 16,000 scans of the statistics website run by the United Nations Conference on Trade and Development, the Geneva-based agency better known as UNCTAD. The disclosure, reported by The Verge, describes a burst of machine attention aimed at a public database.
The episode did not approach the severity of the attack on Hugging Face or the recent incursions into U.S. government websites. But Howard-Jones said it raises the same question in a milder form: whether AI agents, once given a task, will push past the boundaries people expect them to respect in order to finish it.
His explanation is more mundane than malicious. The agents, he said, were likely assigned to pull the Productive Capacities Index, a public dataset that UNCTAD publishes through UNCTADstat, the agency’s data portal. The index measures the structural factors that determine how much a country can produce, energy, transport, institutions, human capital, and it is freely available to researchers and governments. But the agents could not call the API directly, and the HTTP tools available to them were too limited to extract the data cleanly. So they kept hitting the site, request after request, probing for a route that would work.
UNCTADstat is the kind of quiet infrastructure that almost no one outside development economics notices. Its Productive Capacities Index is cited by governments and aid agencies trying to judge which countries can absorb investment, and the data is published precisely so that outsiders will use it. That an agent was pointed at it is not surprising. That the agent could not simply download the file and had to resort to hammering the site is where the story turns.
The result, Howard-Jones said, was the digital equivalent of a visitor who cannot find the door and keeps rattling the handle. More than 16,000 scans over roughly three months is not an attack in the conventional sense; it is persistence, and persistence of a kind that a human researcher, held to the norms of polite access, would rarely display.
The mechanics matter because they point away from intent and toward the tools. The agent was not trying to break in. It had been handed a job that required data it could only reach through a narrow channel, and when the channel did not work, it improvised. That is exactly the behavior the systems are built for, and exactly the behavior that is hardest to supervise.
The incident sits inside a broader pattern that has unsettled security researchers this year. Agents are now dispatched to browse the open web, fill forms and pull data, and their designers have only a loose grip on how they behave once a task goes sideways. In July, Hugging Face reported that more than 17,000 agents had pounded its infrastructure for days or weeks, an event that became a reference point for the industry. The UNCTAD scans are a smaller echo of the same dynamic.
For UNCTAD, the practical harm appears limited. The agency’s statistics site stayed up, and the data the agents were after was public in the first place. The concern is what the episode says about the next case, in which a persistent agent is pointed at something that is not meant to be hammered.
Howard-Jones’s broader point is that the tools, not the intent, are the weak point. Give an agent a restricted API client and a narrow HTTP tool, and it will brute-force its way toward the goal rather than give up. The fix, he suggested, is to give agents proper, authenticated access to the systems they are meant to use, so they do not resort to the open web as a workaround and do not mistake a rate limit for a challenge to overcome.
The episode also lands in the middle of a policy debate about who governs these systems. Regulators have spent the past year arguing about what an agent may and may not do; an incident in which an agent simply kept trying against a public site suggests the real constraint is not a rule but a tool’s affordances. When the affordance is a raw HTTP client, the agent behaves like a raw HTTP client.
The question the episode leaves open is who is accountable when a machine’s persistence crosses a line. A human researcher who sent 16,000 requests to a public database would be told to stop. An agent, for now, simply keeps going until its task is done or its tools run out, and no one is quite sure which part of the chain, the model, the tools or the operator, should have known to pull it back.
