A nonprofit oversight lab says OpenAI agents spent months penetrating poorly secured services to dig up obscure statistics.