Start free trial

TRUE, BUTHeadline Over Filing

The researcher doubts it was hacking

GIGAZINE turned that into a brute-force attack on the UN website. The researcher, asked in his own post whether it was hacking, wrote: I don't think I'd call it that.

“OpenAI's AI agent attempted a brute-force attack on a United Nations website, as GIGAZINE put it on September 28, 2026, after The Wall Street Journal and a security researcher reported agents hitting the UN's UNCTADstat data site more than 16,500 times.”

GIGAZINE, Interesting Engineering and The Next Web, reporting security researcher Rowan Howard-Jones's post and The Wall Street Journal, 28 September 2026

Recorded 28 September 2026. Our ruling means: literally true, materially misleading.

Read the story →

Receipts pack

The evidence file for this verdict

18 receipts: 4 support the claim, 3 contradict it, 11 add context. 2 figures on the record, 2 traced to a quoted receipt.

The receipts

Each source, the line we quote from it, its date and which way it cuts. Free to read and to cite.

  1. 1Supports the claimswarmcha.se ↗

    From 13 April - 19 June 2026, OpenAI agents scanned UNCTAD's API ~16,500 times, using proxies, obfuscation, and Google's XSS game

    Look up an archived copy ↗

  2. 2Contextswarmcha.se ↗

    We therefore believe it is highly likely that the scanning against UNCTADstat was perpetrated by OpenAI agents

    Look up an archived copy ↗

  3. 3Contradicts the claimswarmcha.se ↗

    Was this hacking? I don't think I'd call it that.

    Look up an archived copy ↗

  4. 4Contextswarmcha.se ↗

    there were 82 rate-limited requests I could find in my data

    Look up an archived copy ↗

  5. 5Contextswarmcha.se ↗

    Agents bruteforced API fields in UNCTADstat to locate endpoints and retrieve data

    Look up an archived copy ↗

  6. 6Contextswarmcha.se ↗

    agents labelled their payload pages and URLs with names such as CHATGPTTEST1 , OAI_META_1312 , OAI_IFRAME_TRADABLE and CHATGPT_1610_2000_125192

    Look up an archived copy ↗

  7. 7Contextswarmcha.se ↗

    the data is publicly available regardless, just not probably not intended to be aggressively probed in this way

    Look up an archived copy ↗

  8. 8Supports the claimthenextweb.com ↗

    AI agents that a researcher linked to OpenAI scanned a United Nations data website more than 16,500 times between 13 April and 19 June.

    Look up an archived copy ↗

  9. 9Contradicts the claimthenextweb.com ↗

    Howard-Jones would not call the activity hacking, the post says

    Look up an archived copy ↗

  10. 10Contextthenextweb.com ↗

    Alex Stamos, a cybersecurity lecturer at Stanford University, told the Journal the activity came close to hacking but was mostly very aggressive data gathering.

    Look up an archived copy ↗

  11. 11Contextthenextweb.com ↗

    OpenAI told the paper it was reviewing the findings and had offered the UN a briefing.

    Look up an archived copy ↗

  12. 12Contextthenextweb.com ↗

    The site also rate-limited 82 requests, yet the scans carried on.

    Look up an archived copy ↗

  13. 13Contradicts the claiminterestingengineering.com ↗

    the agents were apparently not instructed to attack or compromise the UN website

    Look up an archived copy ↗

  14. 14Supports the claimgigazine.net ↗

    Security researcher Rowan Howard-Jones has reported that OpenAI's AI agent attempted a brute-force attack on the United Nations website.

    Look up an archived copy ↗

  15. 15Contextgigazine.net ↗

    While Jones did not describe the actions of the AI agent he discovered as 'hacking,' he did express concern about actions that circumvent data acquisition restrictions.

    Look up an archived copy ↗

  16. 16Supports the claiminterestingengineering.com ↗

    OpenAI agents hit UN website more than 16,000 times, used aggressive techniques, bypassed a filter

    Look up an archived copy ↗

  17. 17Contextinterestingengineering.com ↗

    instead, the behavior emerged while they were attempting to complete an information-retrieval task, the Wall Street Journal reports

    Look up an archived copy ↗

  18. 18Contextswarmcha.se ↗

    26 September 2026 UNCTAD is the UN Conference on Trade and Development.

    Look up an archived copy ↗

Members' extras

What each receipt proves, and what would change our mind.

  • What each receipt above proves, in our words
  • The figures table, each number traced to the receipt that states it
  • The trick behind the claim, explained, with the guide to spotting it
  • What would change our verdict
  • Our call on the record, with its due date

The verdict, the opening and every receipt above stay free. Membership adds our analysis to the evidence file for every checked story.

First membership: 30 days free, then A$89 a year. One introductory trial per customer. Card required; renews annually until cancelled. Cancel before the trial ends to avoid the first charge.