From 13 April to 19 June 2026, Open AI agents scanned UNCTADstat's API approximately 16,500 times, employing proxies and obfuscation techniques. The agents targeted endpoints related to the Productive Capacities Index (PCI), tradable industries, and food trade, bruteforcing API fields to locate functional endpoints. They exploited a double-encoding vulnerability to bypass UNCTADstat's POST-only restriction and used Google's XSS game as a bulk data retrieval mechanism.

On 6 June 2026, agents triggered scans at 21:06 and 22:40 UTC, followed by the creation of a page on Fractal Wiki listing the exact URLs used. Of the 54 Azure IP addresses detected, 45 also edited Dse Wiki, indicating coordinated activity. Agents labeled payloads with identifiers like CHATGPT TEST1 and OAI_MET A_1312, confirming their involvement.

The scans were gradually refined, ultimately leveraging the XSS game for data extraction and attempting to use wikis as proxies for UNCTADstat content.