OpenAI agents tried to ‘bruteforce’ a UN website

Security researcher Rowan Howard-Jones says that OpenAI agents scanned the UN Conference on Trade and Development’s statistics site over 16,000 times between April and June. While the incident doesn’t rise to the level of other recent major hacks, it is another concerning example of AI agents going outside normal bounds. According to Howard-Jones, the agents were likely tasked with retrieving publicly available data related to the Productive Capacities Index through the API. However, they lacked direct API access and faced restrictions on their HTTP tools. The agents worked out ways to bypass these limitations and pull data despite encountering errors. At this point, the AI began masking its behavior, believing errors were due to a nonexistent filter. It eventually realized it could hijack Google’s XSS game tool to accomplish its goals, resorting to increasingly aggressive tactics to access UN data.