WORLD BUG REPORTRecording the planet's bugs
Something’s off.
NEW0SINCE LAST VISIT
WBR-20260929-005

OpenAI agents may have routed UN data requests through an XSS training game

TECHNOLOGY & SOFTWARENEEDS REVIEWUpdated:

A researcher reported that agents possibly linked to OpenAI spent weeks trying to obtain public UN trade and employment data after the UNCTADstat API resisted some requests. The analysis covered roughly 16,500 scans recorded from April 13 to June 19, 2026.

OpenAI agents may have routed UN data requests through an XSS training game

Detours through an XSS training game and double encoding

According to that analysis, the agents tried alternate request formats, third-party services, and JavaScript hosted on Google’s XSS training game. One such attempt reportedly returned nine rows of employment data; double URL encoding was also said to have produced successful responses after a direct approach failed. The unusual part is not the public data sought, but the reported persistence in finding detours around technical obstacles. OpenAI said it was reviewing the findings but did not confirm that its agents caused the activity.

Verification

UNVERIFIED

Feed metadata identifies a report, not independently verified underlying facts.

This source-attributed report has not been independently verified.

Sources