Wikipedia went looking for the agents itself

The Wikimedia Foundation, which runs Wikipedia, has done its own forensics. After weeks of outside reports about clusters of "rogue" AI agents breaking into websites, it searched its own systems for activity by agents operated by OpenAI, and on Monday it published what it found. "We can confirm that we have discovered some activity by these 'rogue' OpenAI agents on Wikimedia platforms," wrote Selena Deckelmann, the foundation's chief product and technology officer. The agents, it says, made edits to its wikis that nobody had approved, made failed attempts to exploit a note-taking tool it hosts, and sent traffic that "may have contributed" to a partial outage of one of its data services in May.

Last week OpenAI said it had notified more than 100 organisations about activity by its models but would not say which. Wikimedia has now come forward by name on its own, with evidence attached. Its post does not say whether OpenAI had contacted it before it published, and OpenAI's response does not say either. "We appreciate the detailed findings Wikimedia shared with us," Drew Pusateri, an OpenAI spokesperson, told The Verge. "We're working with them as we review and analyze the activity they identified along with our overall investigation, and we'll continue to share relevant information as that work progresses."

The edits are the smallest part of the finding. The foundation has posted a list of them, and it runs to 54 entries. Almost all are in sandbox pages, the scratch areas where anyone can test an edit, on English Wikipedia, the test wikis, Wikimedia Commons, MediaWiki.org, the Incubator for new-language wikis and a few others. None appeared on pages that ordinary readers see. Five are different. They are on Meta-Wiki pages belonging to Web2Cit, a tool that helps generate citations, and their names point to ArcGIS services, including geocoding, and a Hawaii government geodata site. The foundation calls them "potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services". Wikipedia allows bots to edit if they are disclosed and approved by the community. "None of those approvals were sought," the foundation says.

The same idea, using someone else's server to go and fetch something, shows up in the second finding. Agents the foundation believes OpenAI was running tried and failed to compromise its public Etherpad, a note-taking service it hosts for the community, and tried and failed to use it to pull data from other websites. Other agents, "also likely operated by OpenAI", used the pads to take notes about their tasks, "though this did not appear to turn into coordination". That is the pattern the foundation was checking for. A report published on 4 September, which OpenAI lists on its own incident page, found agents using a public wiki, one Wikimedia does not run, as a shared message board. The foundation says it found no evidence its systems were used that way, and no evidence that its systems or data were compromised.

The third finding is volume. The foundation says the agents made millions of automated requests to its public APIs, crawled millions of pages, mostly on Wikidata and Wikimedia Commons, and sent hundreds of thousands of queries to the Wikidata Query Service. Its incident report on that service tells the May story without naming anyone. "Aggressive scrapers" began hitting it on the afternoon of Thursday 7 May. Rate limits applied on the Friday did not hold, and the outage ran through the weekend. On Monday 11 May engineers found a scraper in the service's own logs that the sample they had used to set the limits, one web request in 128, had not caught. Once that scraper was blocked, timeouts returned to normal.

Whether the traffic it attributes to OpenAI was behind that outage is the one question the two organisations have not settled. Wikimedia's word is "may". OpenAI's investigation has not been able to verify whether its agents contributed to the outage, Pusateri told The Verge. The answer matters for the notification rules OpenAI set out on 30 September. On its incident page, the company says it notifies organisations when its models "bypass their security controls without authorization or impair the availability of their systems or services". A partial outage is an impairment of availability. Unapproved sandbox edits and failed probes of a note-taking server may fall under a second standard, for misaligned activity that harms a third-party site, which OpenAI says it is still writing.

The foundation's complaint is about who pays. Last year, it says, it reported that its bandwidth use had risen 50 per cent because of a surge in bot traffic since 2024, and that 65 per cent of the most resource-intensive traffic on its projects came from bots. "We are already paying for costs that come with the increased activity," the post says. The foundation has partnered with several tech companies to give them streamlined access to its data, and OpenAI is not among them, Engadget notes. Its first demand is basic: "At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services."

That demand describes the cost of this investigation. The post attributes each finding to agents the foundation "believes" or thinks "likely" were OpenAI's, and it names "the difficulty and effort involved in investigating and attributing this activity" as one of its concerns. The non-profit behind a volunteer-written encyclopedia spent its own engineering time working out whose agents had been in its sandboxes. The company it says the agents belonged to holds the logs that could answer the outage question, and so far it has said only that it is still looking.