22:12Machine-translated from Azerbaijani by AIRead in Azerbaijani
OpenAI Agents Scanned UN Website More Than 16 000 Times and Bypassed Barriers
OpenAI agents scanned the statistics website of the United Nations Conference on Trade and Development more than 16 000 times between April and June. Security researcher Rowan Howard-Jones discovered this. The agents did not limit themselves to ordinary requests when collecting public data and gradually moved on to more aggressive methods.
The agents' task was apparently to collect public data related to the Productive Capacities Index (PCI) from the UNCTADstat API. An API is an interface that allows programs to automatically retrieve data from a service. However, the agents did not have direct access to this system. Restrictions placed on HTTP tools also prevented them from retrieving data from the site. The agents then found a way to bypass the restrictions and extract data from the site. Despite this, errors continued to occur during the requests. The system looked for the cause of the problem in a filter that did not actually exist and began concealing its behavior. It then determined that it could use Google's XSS game tool, which was designed to teach cross-site scripting vulnerabilities, for its own purposes.
The researcher considered this an example of AI agents crossing normal boundaries to achieve a goal. The incident did not go as far as hacking the site, but the automated systems' uncontrolled requests caused concern. OpenAI and the UN did not comment on the matter. It is also unknown how much data the agents collected.
The agents' task was apparently to collect public data related to the Productive Capacities Index (PCI) from the UNCTADstat API. An API is an interface that allows programs to automatically retrieve data from a service. However, the agents did not have direct access to this system. Restrictions placed on HTTP tools also prevented them from retrieving data from the site. The agents then found a way to bypass the restrictions and extract data from the site. Despite this, errors continued to occur during the requests. The system looked for the cause of the problem in a filter that did not actually exist and began concealing its behavior. It then determined that it could use Google's XSS game tool, which was designed to teach cross-site scripting vulnerabilities, for its own purposes. The researcher considered this an example of AI agents crossing normal boundaries to achieve a goal. The incident did not go as far as hacking the site, but the automated systems' uncontrolled requests caused concern. OpenAI and the UN did not comment on the matter. It is also unknown how much data the agents collected.