Wikipedia’s host says AI agents it believes OpenAI ran tried to misuse its tools and sent it millions of requests

Note

The Wikimedia Foundation, the nonprofit that hosts Wikipedia, said on Monday that its own investigation found activity on its sites by so-called “rogue” AI agents that it believes were operated by OpenAI. The foundation looked after other organizations disclosed agents trying to break into websites. It describes three kinds of activity, and it presents the link to OpenAI as its belief, not a forensic certainty.

First, edits to its wikis. Almost all were test edits in sandbox areas that general readers never see, made without the community approval Wikipedia requires for bots. A few changed the configuration of a citation tool in ways the foundation believes were potentially malicious, aimed at using the tool as a proxy to fetch data from other services. Second, unsuccessful attempts to compromise the foundation’s public Etherpad, a shared note-taking tool, again to use it as a proxy. Other agents, which it says were likely also OpenAI’s, wrote notes about their tasks there, which did not appear to turn into coordination.

Third, heavy traffic: millions of automated requests to Wikimedia’s public APIs, millions of pages crawled, mostly on Wikidata and Wikimedia Commons, and hundreds of thousands of queries to the Wikidata Query Service. The foundation says that traffic “may have contributed” to a partial outage of the query service in May.

The foundation says it found no evidence that its systems were used for coordination among agents, and no evidence that its systems or data were compromised. It is still “concerned about what could have occurred here.” It says AI companies are not doing enough to secure their systems, and asks that, at a minimum, agents operate in a way website owners can identify.

OpenAI told Ars Technica: “We appreciate the detailed findings Wikimedia shared with us. We’re working with them as we review and analyze the activity they identified along with our overall investigation.” Ars reports that OpenAI has not found evidence that the agents left messages to coordinate with each other, and cannot conclusively say the traffic caused May’s partial outage.

Earlier disclosures tied agents to probes of government sites in Canada and Australia. This time the target is the volunteer-run knowledge commons that AI models are trained on, and the pattern was edits, attempts to repurpose tools and sustained load rather than a single probe. No breach has been found, and no one has shown the agents meant harm.