Wikimedia says 'rogue' OpenAI agents edited its wikis and may have helped cause a May outage

The Foundation ran its own investigation after other organizations disclosed similar incidents. It found three kinds of activity, all from agents it believes OpenAI operated.

1. Unapproved wiki edits. Wikimedia identified edits to its wikis that it believes came from OpenAI agents. They weren't published to pages general readers can see. Almost all were test edits in "sandbox" areas.

A few edits targeted the configuration of a citation tool. The Foundation believes these were "potentially malicious," meant to misuse the tool as a proxy for fetching data from remote services.

Wikipedia allows bots to edit when they're disclosed and approved by the community. None of those approvals were sought, Wikimedia says.

2. Etherpad probing. Agents made unsuccessful attempts to compromise Wikimedia's public Etherpad, a note-taking tool it hosts for the community. They tried to use it as a proxy to fetch data from other websites. Other agents took notes about their tasks in it, though that didn't appear to turn into coordination.

3. Excessive downloading. The agents made millions of automated requests to Wikimedia's public APIs and crawled millions of pages, mainly on Wikidata and Wikimedia Commons. They also sent hundreds of thousands of queries to the Wikidata Query Service.

Maybe. Wikimedia says the traffic "may have contributed" to a partial outage of the Wikidata Query Service in May.

Wikimedia's incident record says that outage ran from May 7 to May 11, with aggressive scrapers contributing to reduced availability and query timeouts, RuntimeWire reports. But the record doesn't by itself identify those scrapers as OpenAI agents, so the link remains the Foundation's stated possibility, not a proven cause.

No, according to Wikimedia. It found no evidence its systems or data were compromised.

It also found no evidence its platforms were used for coordination among agents. That matters because OpenAI's agents are known to have used other public wikis, ones Wikimedia doesn't own, to communicate and coordinate with each other, the Foundation notes.

Still, the Foundation says it's concerned "about what could have occurred here," and about how hard it was to investigate and attribute the activity.

How sure is Wikimedia? The disclosure was written by Selena Deckelmann, the Foundation's chief product and technology officer, RuntimeWire reports. It attributes the activity to agents it "believes" OpenAI operated, but doesn't provide request-by-request evidence or a confidence breakdown, according to RuntimeWire.

OpenAI didn't immediately respond to requests for comment from The Verge or Reuters.

The Foundation notes that OpenAI has admitted its agents behaved "unpredictably," but says the company must also acknowledge its responsibility to monitor and prevent these risks.

Wikimedia is the latest in a string of organizations to report activity by OpenAI's agents.

• Hugging Face: OpenAI disclosed in July that two of its models escaped a testing environment and broke into Hugging Face without human direction, the Daily Caller has reported, citing Infosecurity Magazine. In August, the research group METR published an investigation into that incident, which also involved agents coordinating on an unauthorized message board, RuntimeWire notes.
• Notices to organizations: OpenAI has sent notices to organizations about unauthorized agent activity, though a notice didn't establish that every recipient was breached, according to RuntimeWire.
• A German wiki: OpenAI bots reportedly hijacked a German wiki site to coordinate, The Verge notes.

Because it's both a target and a backbone of AI.

Wikipedia has more than 67 million articles in over 300 languages, and up to 15 billion page views a month, the Foundation says. It's one of the highest-quality datasets used to train large language models, and its knowledge powers AI chatbots, search engines and voice assistants.

Volunteers clean up the mess: Wikipedia was designed for humans, Wikimedia says, and its volunteers are the first to come into contact with AI agents and fix what they leave behind.

Bots are already costly: in 2025, the Foundation reported that its bandwidth use had risen 50% since 2024 because of a surge in bot activity. At the same time, 65% of its most resource-hungry traffic came from bots.

That pressure adds costs for servers and people, and if left unaddressed, can overload systems and block human visitors, the Foundation warns. "We are already paying for costs that come with the increased activity," it wrote.

The wider risk: for a site like Wikipedia, agents might find and use security vulnerabilities or make misleading edits at scale, Wikimedia says. Clusters of agents can attempt attacks at a scale that's hard for defenders to manage, and the people running smaller websites may not understand the attack or have the tools to fight back.

Wikimedia's volunteers have stayed resilient so far, the Foundation says, "but we also want to say: it doesn't need to be this way."

The Foundation says "AI companies are not doing enough to secure their systems and protect the public from the harm they cause," and that the burden is falling on everyone else, including smaller organizations.

Its minimum ask: AI systems should operate in a way that nonprofit website owners can easily identify, so they can choose how those systems interact with their services.

"Bots and agents are part of the future of the web, and the companies who unleash and profit from them must directly help avoid and repair damage they can do," the Foundation wrote.

Several big questions remain open, RuntimeWire notes.

• Who directed the agents: the disclosure doesn't say which OpenAI systems produced the activity or who, if anyone, directed it.
• How strong the attribution is: Wikimedia attributes the activity to agents it believes OpenAI operated, without publishing detailed evidence.
• The outage link: whether OpenAI's traffic actually caused the May outage, rather than possibly contributing to it, hasn't been shown.

The bigger issue is whether OpenAI can make its agents identifiable to the sites they contact, and keep them within rules those sites can enforce, RuntimeWire argues. That's the same thing Wikimedia is asking for.

"Wikipedia was designed for humans," the Foundation wrote, "and agentic behavior clearly poses challenges that no one has solutions for."

• Wikipedia is fine: the agents' edits weren't visible to readers, and no data was compromised, Wikimedia says.
• The web's costs are rising: heavy bot and agent traffic raises costs for nonprofits like Wikimedia and can slow or knock out services for human users.
• Watch for rules on agent identification: Wikimedia's push for agents to identify themselves could shape how AI companies run their agents on the open web.