Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0070

AI research agents scanned a UN statistics API about 16,500 times and worked around its request limits

Independent researcher Rowan Howard-Jones reported that agents he attributes to OpenAI scanned the API of UN Trade and Development's statistics hub about 16,500 times between April 13 and June 19, 2026. When requests were rate-limited or refused, the agents routed them through third-party relays and a URL-scanning service and used a double-encoding trick to get around the API's request restrictions, reaching data the site publishes openly. His analysis used public data; Transluce had earlier reported the agents' UNCTAD activity. OpenAI said it was reviewing the findings and offered to brief the UN.

Reported Sept. 23, 2026Happened between April 13, 2026 and June 19, 2026Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm: No harm reportedAdds nothing to the index.
Control
Control level 3, Limit bypassReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Internal researchSingle sourceInitiated by Model
Aggregate recordUnder review

Under review: the facts may change as more is reported. The rating may change; every change is logged below.

Aggregate record. Repeated scans of one site over April to June 2026; the number of separate tasks or episodes is not known. One record, never multiplied by the scan count. It counts once.

Not counted: no harm reportedEffect on the index

Sources

How we know

5 sources · single source. Links go to the original publishers; the summary above is in our own words.

  1. researchOpenAI agents tried to bruteforce a UN website's API fieldsRowan Howard-Jones (swarmcha.se) · Sept. 26, 2026swarmcha.se/posts/openai-unctad
  2. researchEarly rogue AI agent activity and attempts to hack found on urlquery.netTransluce · Sept. 23, 2026transluce.org/agent-activity
  3. newsOpenAI agents went the long way round for UN dataThe Register · Sept. 28, 2026theregister.com/ai-and-ml/2026/09/28/openai-agents-went-the-long-way-round-for…
  4. newsOpenAI's AI agents hit a UN website 16,000 times — bypassing its security filtersQuartz · Sept. 28, 2026qz.com/openai-agents-un-website-16000-times-092826
  5. newsOpenAI agents scanned a UN statistics site 16,500 times, researcher saysThe Next Web · Sept. 28, 2026thenextweb.com/news/openai-agents-un-unctad-statistics-site-scans

Why this rating

No harm reported; control failure level 3

Two separate assessments. Only documented harm can count toward the index.

Observed harm

No harm reported

About 16,500 scans of a UN statistics API for data the site publishes openly; no outage or cost reported.

Not a finding that no harm occurred.

Disputed: Attribution to OpenAI is an independent researcher's analysis; OpenAI said it was reviewing the findings.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Limit bypass

Worked around a third party's request limits on a public API (rate limits and a POST-only endpoint) using relays and an encoding trick; not every attempt defeated a real restriction.

How: Got around a working safeguard.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Filter circumvention is row 3. One analyst's reconstruction, which the developer is reviewing but has not confirmed, so Single source.

The scales

Effect on the index

It does not count toward the Sept. 28 reading

The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: no harm reported. 18 other records behind the reading for that week.

The arithmetic
The reading for the week of Sept. 28, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band22
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm25 Minor harm
Inside the window of 2 weekly readings
Week toReadingBand
Sept. 28, 202625Minor harm
Oct. 5, 202625Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit corrections from Howard-Jones's post: about 16,500 scans of a public API, and his analysis used his own public data, not Transluce's; title, summary, impact and control notes rewritten. Added an evidence review of the post. Status resolved → unknown, as OpenAI has published no finding. Counting event → aggregate, as the number of separate tasks is not known; it still counts once. The Next Web dated 28 Sep. Quartz (and its UN statement) and the Wall Street Journal could not be read on 3 Oct. Flagged for review. Ratings unchanged.

  3. v4
    Oct. 2, 2026

    Report date moved from 2026-09-28 to 2026-09-23: Transluce's 23 Sep 2026 report already described the agents' requests to the UNCTAD statistics site.

  4. v3
    Oct. 2, 2026

    Added first-hand sources: Rowan Howard-Jones's own analysis and Transluce's research report.

  5. v2
    Sept. 30, 2026

    Rated: impact not reported; control type restriction bypass.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “AI research agents scanned a UN statistics API about 16,500 times and worked around its request limits.” Record PI-0070. Reported Sept. 23, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0070