An analysis by Rowan Howard-Jones revealed that AI agents likely from OpenAI executed over 16,500 scans on a UN statistics API between April 13 and June 19, 2026. Limited to GET requests, the agents injected code into a Google web security learning game to relay POST requests and retrieve restricted