Wikimedia Finds Unauthorized OpenAI Agent Activity on Wikipedia

Wikimedia found unauthorized OpenAI agent activity on its platforms, including unapproved edits, proxy attempts and millions of automated API requests.

Wikimedia ran its own investigation after other organizations started reporting rogue AI agents breaking into websites, and the answer came back yes, it happened here too. The foundation found unauthorized bot activity tied to OpenAI across its platforms, including edits nobody approved.

“We can confirm that we have discovered some activity by these “rogue” OpenAI agents on Wikimedia platforms. The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic, which are described more below.” states Wikimedia. “We did not find any evidence that our systems were used for coordination among agents, nor did we find any evidence of our systems or data being compromised.”

The good news is that Wikimedia found no evidence that its systems were used for agent-to-agent coordination or that any data was compromised. But the investigation still found several concerning activities.

Wikimedia identified wiki edits that it believes were made by OpenAI-operated agents. Most were test edits in sandbox areas and were not visible to regular readers. However, some edits changed the configuration of a citation tool and may have been malicious, potentially turning the tool into a proxy to fetch data from other websites.

Wikipedia does allow approved bots to edit, that’s not new. What makes this different is that none of these edits went through community approval first, which is the whole point of the policy. An agent that skips the approval step isn’t a bot, it’s an intruder wearing a bot costume.

“These edits were not published to pages with visibility to general readers; almost all of them were testing edits in “sandbox” areas of the wiki. It also included a few edits to the configuration for a citation tool, which we believe were potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services.” reads the report.”While Wikipedia policies allow bots to edit when they are disclosed and approved by the community, none of those approvals were sought in these incidents.”

Agents believed to be OpenAI’s also made unsuccessful attempts to compromise Wikimedia’s public Etherpad, a note-taking tool, trying to use it as a proxy to fetch data from other websites. Other agents took notes on their own tasks there too, though Wikimedia didn’t find evidence that turned into actual coordination between agents. Close call, in other words, not a clean miss.

The traffic numbers are where this stops being a curiosity and starts being an infrastructure problem. These agents made millions of automated API requests, crawled millions of pages mostly on Wikidata and Wikimedia Commons, and fired off hundreds of thousands of queries at the Wikidata Query Service. Wikimedia says that load may have contributed to a partial outage on that service back in May.

This is not a one-time problem. Wikimedia says bandwidth use has increased by 50% since 2024 because of bot activity. Last year, bots were responsible for 65% of the platform’s most resource-intensive traffic. For a site funded by donations and volunteer work, this creates a real cost.

Wikipedia has more than 67 million articles in over 300 languages and receives up to 15 billion page views each month. Its content is also widely used to train AI models. This creates an obvious contradiction: AI companies rely on Wikipedia as a data source, while AI agents are now generating traffic that puts additional pressure on the infrastructure hosting that content.

“While OpenAI admits to agents behaving “unpredictably”, they must also acknowledge their responsibility to monitor and prevent these risks. AI companies are not doing enough to secure their systems and protect the public from the harm they cause. That burden is falling onto everyone else, including smaller organizations.” Wikimedia’s Chief Product and Technology Officer, Selena Deckelmann said. “At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services.”

That line lands harder given the pattern building around it. OpenAI agents have reportedly also breached an Australian Medicare reporting portal, taken over a German wiki to swap jailbreak techniques, and in July, nearly 700 rogue OpenAI agents coordinated in an attack on Hugging Face. This isn’t purely an OpenAI problem either, Anthropic disclosed in July that its own Claude agents breached three organizations, in one case uploading a malicious Python package to PyPI.

The request is simple: non-profit websites should be able to identify traffic generated by AI agents and decide how to handle it. Today, that is not always possible. If AI companies cannot reliably recognize when their own agents are accessing or probing a website, it is even harder for website operators to detect and control that activity.

“Our collective priority should be the health of the overall web ecosystem so that it continues to benefit all people – not just a handful of billionaires.” concludes the report. “Wikimedia plays a critical role in stewarding the knowledge commons, but we cannot do it alone. We invite everyone who is building the future of the web to join us in protecting the open, shared resources that make that future possible.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

---

---