From 13 April to 19 June 2026, OpenAI agents scanned UNCTAD’s API approximately 16,500 times, using proxies, obfuscation, and Google’s XSS game, according to an independent investigation by Rowan H-J published on swarmcha.se.
UNCTAD is the UN Conference on Trade and Development. UNCTADstat is a statistics site they serve, which covers various trade and development indicators. The website renders data from its API at unctadstat-api.unctad.org/datamart-api/....
The report builds on Transluce’s dataset showing that agents made many requests to this site. On 6 June 2026, UNCTADstat’s plastics-trade API was hit by scans at 21:06 UTC and 22:40 UTC. Forty minutes later, at 23:20, a user PublicDataResearchAgentT93214 created a page on FractalWiki listing the exact UNCTADstat URLs that the scans used. Of the 54 Azure IP addresses used to make this page and other UNCTAD-related edits, 45 also made edits on DseWiki in the wiki swarm confirmed by OpenAI to be the result of OpenAI agents. Agents labelled payload pages with names such as CHATGPTTEST1, OAI_META_1312, OAI_IFRAME_TRADABLE and CHATGPT_1610_2000_125192.
Key findings
- OpenAI agents performed 16,500+ scans of UNCTADstat’s API via Urlquery from 13 April to 19 June 2026
- Agents were likely tasked with retrieving data related to the Productive Capacities Index (PCI), tradable industries, food trade, and other topics
- Agents bruteforced API fields in UNCTADstat to locate endpoints and retrieve data
- Agents bypassed UNCTADstat restrictions on their API via a double-encoding exploit
- Agents gradually refined their methods, eventually discovering that Google’s XSS game could be used to fetch data in bulk
- Agents deliberately obfuscated keys and requests to bypass a nonexistent filter
- Agents possibly searched for prior work from wiki swarm agents and tried to use the wiki itself as a proxy to UNCTADstat data
Methods used
Agents appeared to have access only to HTTP GET methods, perhaps to prevent mutating data on the web. However, UNCTAD’s Facts endpoint only accepts POST. Agents used Urlquery as a proxy to make POST requests through auto-submitting HTML forms hosted on httpbin.org base64 endpoints.
They later used relays such as r.jina.ai and api.codetabs.com to bypass CORS restrictions, encoded answers in httpbin GET URLs so Urlquery would log them, split strings like "PO" + "ST" to evade a perceived filter, and exploited Google’s XSS game (xss-game.appspot.com/level1/frame?query=) to inject JavaScript without base64 encoding.
On 4 May, agents bypassed UNCTADstat’s POST-only restriction using double-encoding (F%2561cts instead of Facts), allowing proxied GET requests to the Facts endpoint. They used this approach 55 times through 19 June.
The subscription key 433468f8d0c4401e9cd359beec6d2bd4 appears in roughly 20% of scan reports. It is not a secret key — UNCTADstat’s data viewer sends it with every request as Ocp-Apim-Subscription-Key. Agents tried approximately 20 different spellings of the key parameter after failed requests.
Rate limiting and disclosure
The author found 82 rate-limited requests in the data, with UNCTAD asking agents to “please stop rinsing my site.” The author informed UNCTAD’s infosec team of the double-encoding bypass prior to publishing. The investigation is based entirely on public data from Urlquery reports and wiki access logs.