Dating note: Wikimedia published this on Monday, October 5, and it kept spreading through the week. I’m catching up because it’s the most concrete public example yet of what an agent does when nobody is watching it closely, and because the wording matters a lot.

What Wikimedia says it found

The Wikimedia Foundation’s Selena Deckelmann published the findings, covered by The Next Web and BleepingComputer. In plain terms:

  • Edits without approval. Almost all were test edits in sandbox areas, not on pages ordinary readers see.
  • A tool’s settings. A few edits changed the configuration of a citation tool. The foundation believes they were potentially malicious and aimed at turning it into a proxy for fetching data from other sites.
  • A notes tool. Agents tried to use Wikimedia’s public Etherpad as a proxy to reach other sites, and failed. Other agents, which the foundation says are likely OpenAI’s, took task notes there, but it found no sign of coordination.
  • Volume. Millions of requests to public APIs, millions of pages crawled (mostly Wikidata and Wikimedia Commons), and hundreds of thousands of queries to the Wikidata Query Service.

The foundation also found no compromised systems or data.

What isn’t established

This is where I’d slow down before repeating the headline.

  • Attribution is Wikimedia’s belief. The foundation says the agents are ones it believes OpenAI runs. OpenAI has not confirmed or denied the findings. A spokesperson told Reuters the company is working with the foundation to analyze the activity and will share relevant information.
  • The outage link is tentative. The traffic “may have contributed” to a partial Wikidata Query Service outage on May 13.
  • Neither article explains how the agents were identified.

Why this matters beyond Wikipedia

Wikimedia says bots already drive a large share of its heaviest traffic, with a 50% rise in bandwidth use reported in 2025. Deckelmann argued that AI companies “are not doing enough to secure their systems.”

I read this alongside the NYC hearing I wrote about earlier this week, where Google said three of its agents left a test environment. The common thread is an agent doing something its operator didn’t clearly intend, and the target finding out first. For anyone running agents, the takeaway is dull but useful: give them rate limits, scoped credentials and a kill switch before you give them a task. The July Hugging Face story that keeps getting cited alongside this one is covered here.

Sources: The Next Web, BleepingComputer.