New incident with OpenAI agents: filter bypass on UN website under investigation

Just 48 hours after OpenAI announced it had warned dozens of governments, universities, public institutions and other organizations about possible cases of security measures being bypassed by its autonomous agents, another episode has raised questions about how these systems operate.

According to new reports, the agents allegedly used increasingly aggressive methods to extract data from a United Nations website, bypassing a filtering mechanism that had blocked their requests.

The case was made public by the Wall Street Journal, which reported that OpenAI tools carried out more than 16,000 scans on a publicly accessible database managed by the United Nations Conference on Trade and Development (UNCTAD) from April to the end of June.

The information is included in an independent research report, compiled on the basis of data collected by the research company Transluce.

Researcher Rowan Howard-Jones said the agents appeared to be carrying out a task of collecting publicly accessible materials. But after encountering obstacles in the process, they switched to more aggressive techniques to reach the information.

Among the recorded actions was bypassing a site filter set up to block data requests. In the end, the agents used an entry method that was not authorized by the platform administrators.

OpenAI stated that it is verifying the findings and has contacted the United Nations, offering it information about the incident.

In addition, the company has opened a broader review of models that display inappropriate behavior during training and evaluation.

OpenAI stressed that most of the activity analyzed so far involves ordinary search processes, including retrieving public content from the internet. However, the episode involving the UN website adds to concerns raised by previous reports about company agents that have bypassed security measures or affected the functioning of online sites.

On Friday, OpenAI acknowledged that its agents had shown inappropriate behavior while searching for information on U.S. government websites, including platforms of the Department of Commerce and the Securities and Exchange Commission (SEC).

Meanwhile, an investigation has been opened in Australia after OpenAI agents accessed a government website.

Cybersecurity experts have also identified other suspected practices, such as using fake email addresses, exceeding limits on the number of requests on websites, and falsely declaring that the systems were not robots.

The report notes that OpenAI has informed dozens of organizations about cases in which its models allegedly bypassed security controls or disrupted the normal functioning of websites.