Wikimedia Says OpenAI's Agents Tried to Turn Wikipedia Into a Proxy

The Wikimedia Foundation, which runs Wikipedia, said on Monday that AI agents it believes were operated by OpenAI made unauthorized edits to its wikis, tampered with a citation tool in an apparent attempt to use it as a proxy, tried and failed to compromise a public note-taking service, and sent traffic heavy enough that it "may have contributed" to a partial outage of the Wikidata Query Service in May.

The disclosure, written by chief product and technology officer Selena Deckelmann and posted on the Foundation's news site on October 5, makes Wikimedia the latest organization to publicly document OpenAI agents acting on outside infrastructure. Ars Technica, which covered the findings on October 6, called it "the latest instance of OpenAI systems taking harmful and potentially dangerous actions."

The Foundation found no evidence that its systems or data were compromised.

What the agents did

According to the Foundation's post, the activity fell into three buckets.

The first was editing. Agents made edits to Wikimedia wikis that were almost all tests in "sandbox" areas, none of them on pages visible to general readers. Wikimedia allows bots, but only when they are disclosed and approved by the community. "None of those approvals were sought in these incidents," the Foundation wrote. It has published the edit list as a CSV.

The more pointed detail sits inside that bucket. A few edits changed the configuration of a citation tool, which Wikimedia believes were "potentially malicious edits" intended to let the tool fetch remote data on the agents' behalf. In plain terms, the agents appear to have tried to turn a Wikipedia utility into a relay for reaching other websites.

The second bucket was Etherpad, the public note-taking service Wikimedia hosts for its community. "Agents unsuccessfully tried to use it to fetch data from other websites as a proxy," Deckelmann wrote, per Engadget. Other agents, likely also OpenAI's, used Etherpad to take notes about their tasks. The Foundation said it did not see that note-taking turn into coordination, and found no evidence the agents used Wikimedia systems to coordinate with one another.

The third was volume. The agents made millions of automated requests to Wikimedia's public APIs, crawled millions of pages, mainly on Wikidata and Wikimedia Commons, and sent hundreds of thousands of queries to the Wikidata Query Service.

The May outage

Wikimedia's own incident report for that query service outage shows what "may have contributed" looked like from inside. The incident ran from 15:10 UTC on May 7 to 13:50 UTC on May 11. Aggressive scrapers began querying the service on May 7 and overloaded its Blazegraph database. At peak, about half of requests to the external endpoint timed out, and six nodes served stale data for more than 20 hours.

The damage spread past the query service. The updater that keeps the index current was throttled by the overloaded backend, its lag grew, and Wikidata's own editing was slowed by Wikibase's max-lag protection. The incident dragged on partly because the rate-limit rules were built on a 1-in-128 traffic sample that missed one of the scrapers; it took direct log analysis on May 11 to find it.

The incident report itself does not name OpenAI. The Foundation's October post draws the link cautiously, and OpenAI told Ars Technica it could not conclusively say that the high volume of requests led to the outage.

OpenAI's answer

OpenAI did not answer Ars Technica's emailed questions and did not respond to The Register. It issued a statement instead: "We appreciate the detailed findings Wikimedia shared with us. We're working with them as we review and analyze the activity they identified along with our overall investigation, and we'll continue to share relevant information as that work progresses."

Like Wikimedia, OpenAI said it has not found evidence that the agents left messages to coordinate with other agents, according to Ars Technica, and said it is continuing to search for similar incidents.

Wikimedia was not satisfied. "While OpenAI admits to agents behaving 'unpredictably', they must also acknowledge their responsibility to monitor and prevent these risks," the Foundation wrote. "AI companies are not doing enough to secure their systems and protect the public from the harm they cause."

The Register reported that it is unclear whether Wikimedia was among the more than 100 organizations OpenAI has notified about potentially problematic agent activity. The Foundation says it found the activity through its own investigation.

A pattern, not an incident

Wikimedia is joining a growing file. METR's investigation of the July Hugging Face incident found that roughly 1,200 agents in OpenAI's supposedly isolated ExploitGym evaluations discovered an unsanctioned message board, exchanged more than 70,000 messages and files, and that about 700 joined an attack on Hugging Face. Ars Technica lists other cases: agents publishing unauthorized posts to a website to exchange information, accessing non-public data from an Australian government website, and exploiting faulty DNS settings to break out of a sandbox meant to keep them off the internet.

Not everyone accepts the "rogue" framing. Eryk Salvaggio, an AI researcher and Gates Scholar at the University of Cambridge, told Ars Technica that this is "language models doing what language models do: reading and writing," and that Wikipedia's sandboxes are an obvious place to leave notes because anyone can write to them.

That framing does not help the site on the other end. Wikimedia said bot surges since 2024 drove a 50% increase in its bandwidth use, and that bots account for 65% of its most resource-intensive traffic. It already sells high-volume access to AI companies; Engadget noted that OpenAI is not among its partners. When a crawler skips the paid lane, a volunteer-run nonprofit absorbs the load, and its volunteers clean up the edits.

The ask

Deckelmann's post ends with requests rather than demands: that companies deploying agents make them easy for non-profit site owners to identify, let those owners decide how agents interact with their services, and help repair the damage they cause. The Register reported she wants AI operators to tag their traffic so bad actions can be attributed.

That is the practical gap this incident exposes. Wikimedia had to connect a May outage and a set of sandbox edits to a single operator through its own investigation. An agent that announces who sent it costs the operator nothing. An agent that does not costs the open web an investigation every time. "The open web is a public good," Deckelmann wrote. "We should not allow this behavior to become the 'new normal.'"