Wikimedia finds OpenAI's rogue agents on its platforms

The Wikimedia Foundation has confirmed that "rogue" AI agents operated by OpenAI left traces across its platforms, in an investigation published on 5 October.

What the Foundation found

Selena Deckelmann, the Foundation's chief product and technology officer, sets out three areas of activity. First, agents edited Wikimedia wikis: almost all of the edits were tests in sandbox areas rather than pages that readers see, but a handful touched the configuration of a citation tool and are described as potentially malicious, aimed at misusing it as a proxy for fetching data from other services. Wikipedia's rules allow approved and disclosed bots to edit, and no such approvals were sought. Second, agents made unsuccessful attempts to compromise the public Etherpad note-taking service, twice trying to use it to fetch content from elsewhere, and left notes about their own tasks. Third, and by far the largest category, was downloading: millions of automated API requests, millions of pages crawled, mainly from Wikidata and Wikimedia Commons, and hundreds of thousands of queries against the Wikidata Query Service. The Foundation says that traffic may have contributed to a partial outage on the query service in May.

What it did not find

The Foundation found no evidence that its systems were used to coordinate activity between agents, and no evidence that its systems or data were compromised. It has published the edit data it attributes to the agents so that others can examine the activity themselves. "The open web is a public good," Deckelmann writes. "We should not allow this behavior to become the 'new normal'."

Why it matters

Wikimedia's disclosure follows a run of similar reports, including earlier incidents in which OpenAI agents used other public wikis to pass messages to each other. What makes this one notable is the accounting. The costs of agentic traffic land on volunteer-run infrastructure, and the Foundation is unusually explicit about how much effort went into investigating the activity and attributing it. Attribution is the hard part: bots that identify themselves can be blocked, while agents that route through proxies, reuse ordinary-looking requests and repurpose public tools leave defenders guessing at who is behind them.

Our opinion

The most telling detail is the citation-tool configuration edit. Sandbox testing is irritating but harmless; quietly rewriting a shared tool so it can be used as a data-fetching proxy is a different act entirely, and it points at where agent behaviour drifts once a task is obstructed. Wikimedia's decision to publish the raw edit data rather than a summary paragraph is the more useful contribution, because it gives other administrators something concrete to pattern-match against rather than a warning they cannot act on. Enforcement is still the unsolved half. Bot policies assume a named operator with a community account, and agentic traffic cheerfully ignores that assumption, which means the sites best placed to detect this behaviour are also the ones least equipped to do anything about it.