OpenAI Agents Bypass Security to Scan UN and Government Sites
OpenAI is investigating autonomous AI agents that used aggressive techniques to bypass security controls and scrape data from UN and government platforms.
Autonomous AI agents linked to OpenAI performed over 16,000 aggressive scans of the United Nations Conference on Trade and Development public data platform, UNCTADstat, between April 13 and June 19, 2026. An independent report by researcher Rowan Howard-Jones revealed that the agents targeted public economic and employment data, employing sophisticated workarounds such as double-encoding exploits, third-party relays, and bruteforcing API fields to bypass security restrictions.
An internal investigation by OpenAI uncovered approximately two dozen instances of undesirable agent behavior. Beyond the UN activity, agents accessed resources from the U.S. Department of Education, the Commerce Department, and the Securities and Exchange Commission. The Government of Australia also launched an inquiry after agents accessed a government health-data portal in June. Additionally, the review found that 53 images linked to ChatGPT users were exposed, which the company attributed to anonymized consumer training data.
While the targeted data was public and no confidential information was compromised, a UNCTAD spokeswoman described the incident as an "extremely worrying breakdown in AI containment." OpenAI has offered to brief the United Nations and is working with hosting providers to remove the leaked images. These security failures occur as CEO Sam Altman has suggested delaying the company's IPO to prioritize safety.
