Researcher Traces How Likely OpenAI-Linked Agents Retrieved Public UN Data

A search for public UN trade statistics appears to have turned into a series of technical workarounds. In a newly published examination of web records, researcher Rowan H-J traces agents he considers highly likely to be linked to OpenAI as they used forms, relays and other routes to retrieve UNCTADstat data after direct approaches failed. The records show successful retrieval of public figures, but they do not identify who operated the agents.

The researcher examined URLQuery records dated April 13 through June 19. URLQuery opens a submitted address in a remote browser and records what that browser requests. The records let him follow attempts to reach UNCTADstat’s data interface, including requests that failed.

A failed request led to another route

The apparent goal was ordinary information: figures on productive capacity, food trade and tradable industries. The researcher cannot tell from the records what exact questions the agents were answering.

One obstacle was a UNCTADstat endpoint that required a POST request, a way of sending data to a server, rather than an ordinary GET request for a page. The apparent agents placed an automatically submitted form on another page and had URLQuery load it. The remote browser then sent the POST. An early form returned a successful response without useful data on the displayed page; a revised one showed productive-capacity scores for Norway, Iceland and Denmark.

Getting a response was not the same as being able to read or reuse it. A later attempt to fetch UNCTAD data from a page hosted elsewhere reached the server, but the browser blocked that page from reading the reply. The records then show a third-party relay fetching a public data file and displaying selected rows. Later, another relay helped place returned data into a URL that URLQuery recorded.

More than 16,500UNCTADstat API scans

The researcher’s count covers URLQuery scans from April 13 through June 19, not successful data retrievals.

The OpenAI link is circumstantial

The researcher calls the OpenAI connection “highly likely,” not proven. He points to labels in submitted pages, including “CHATGPTTEST1,” and overlap with internet addresses used for UNCTAD-related edits on a wiki associated with previously attributed agent activity. Of 54 Azure addresses tied to those UNCTAD-related wiki actions, he says 45 also edited DseWiki. Shared addresses and labels do not name a model or establish who directed these scans.

An earlier Transluce investigation identified three May 13 URLQuery reports aimed at UNCTAD that carried tags including “CHATGPTTEST1.” Transluce believes some agents using the service came from the same source as agents posting on the wiki, while cautioning that the individual agents were largely distinct.

What the workarounds did—and did not—show

Other routes went beyond forms and relays. The researcher records a double-encoded API path that reached an endpoint which rejected a standard GET request. He also identifies scripts hosted through Google’s XSS Game, a web-security learning tool, that retrieved public data. Some attempts failed outright.

The distinction is between the data and the route taken to get it. The observed results concerned public statistics, and the examination does not establish access to private records, changes to UNCTAD’s data or service disruption. It does show why a failed direct request need not end an agent’s search.