On October 5, the Wikimedia Foundation, which runs Wikipedia, published findings about unauthorized activity on its wikis that it attributes to AI agents it believes OpenAI operated. It described edits made without approval, attempts to use its tools as a proxy for reaching other sites, and heavy automated traffic. It said it found no evidence that its systems or data were compromised.
BleepingComputer and The Register reported the findings on October 6. Selena Deckelmann, Wikimedia’s chief product and technology officer, called it “rogue agent activities.” Nobody got hacked, and I think that’s the interesting part.
What they found
Start with the edits. Deckelmann said “almost all” went to sandbox pages, the practice areas readers never see. Wikipedia does let bots edit if the community has approved them and they say what they are. Wikimedia says these agents never asked.
Then the tools. A few edits touched the settings of a citation tool, and Wikimedia calls them “potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services.” In plain terms, the agents seem to have tried to borrow Wikimedia’s own machinery to reach other websites. Agents also tried the same trick with a public note-taking tool, and it failed. They did use it to jot notes about their own tasks, though Wikimedia doesn’t think those notes show any coordination.
Then the traffic. Wikimedia says “millions of automated requests” hit its public API, plus hundreds of thousands of queries to the Wikidata Query Service. It thinks that may have played a part in a partial outage in May. Note the “may.” The foundation isn’t blaming the agents for the whole thing.
OpenAI’s side, such as it is
There isn’t much of it yet. The Register says OpenAI didn’t answer its questions, which tells you something on its own. Both stories say OpenAI has admitted its agents behaved “unpredictably,” but neither quotes the original statement, so I wouldn’t build anything on that exact word.
One more detail from The Register: OpenAI has told more than 100 organizations about potentially problematic activity by its agents. Was Wikimedia one of them? Unclear. Wikimedia says it found all this on its own.
Why I care
This is the boring version of agents going wrong. No breach, no stolen data, mostly sandbox edits. Just a pile of small actions nobody approved, aimed at tools never built for them, and someone else paying for the load.
And that load is already heavy. Wikimedia says bots make up 65 percent of its most resource-hungry traffic, and its bandwidth use is up 50 percent since 2024. Agents working at machine speed only add to it.
One thing I can’t tell you is whether the agents acted on their own or were pointed at Wikimedia by a person. Neither story says, and the answer changes the fix. If they wandered off, that’s a containment problem. If someone aimed them, it’s an accountability problem.
What Wikimedia wants
Deckelmann didn’t hold back. She said AI companies “are not doing enough to secure their systems and protect the public from the harm they cause,” and that OpenAI must “acknowledge their responsibility to monitor and prevent these risks.”
Her concrete ask is the one I’d back. She wants AI operators required to label their traffic, so a site doesn’t have to play detective to figure out who’s knocking. It’s cheap, and it wouldn’t stop a single agent from misbehaving. It would just make “who did this?” a question with an answer, which today it often isn’t.
What to take from it
If you run a site, decide now what agent traffic may touch. If you build agents, “we didn’t breach anything” is a low bar. The better test is whether the agent asked first, and by Wikimedia’s account, these didn’t.
For now these are Wikimedia’s claims, and I’d read them that way until OpenAI gives a fuller answer.
Sources: Wikimedia Foundation statements as reported by BleepingComputer and The Register, both October 6.
Chris Meredith writes about AI, technology, and what it actually means for real people. Follow along on Substack: monkeyattack.substack.com
