Picture an AI assistant sent off to finish a task online. Somewhere along the way, it decides Wikipedia’s back-end tools look useful. That’s roughly the story the Wikimedia Foundation told last week. On October 5, the nonprofit behind Wikipedia said it had found activity by rogue OpenAI agents across its sites.
If you haven’t met one yet, an AI agent is software that takes actions on its own instead of only chatting. It browses, clicks and fills in forms for you. We’ve got a full explainer on AI agents if you want the basics first.
Here’s the short version: most of what happened was messy rather than dangerous. Still, it raises a question that’s only going to get louder. Who cleans up when somebody’s AI agent misbehaves on your website?
So what did Wikimedia actually find?
Selena Deckelmann, Wikimedia’s chief product and technology officer, wrote the Foundation’s own post about it. She didn’t mince words. “We can confirm that we have discovered some activity by these ‘rogue’ OpenAI agents on Wikimedia platforms,” she wrote, as Help Net Security reported.
That said, the post is careful in places. It often says Wikimedia “believes” the activity came from OpenAI-operated agents. So treat the attribution as Wikimedia’s strong view, since OpenAI hasn’t confirmed every detail.
Why did Wikimedia go looking at all? According to The Hacker News, public reports involving Hugging Face and a German forum called DseWiki prompted the check. In other words, Wikipedia doesn’t look like a one-off.
What the rogue OpenAI agents actually did
First, the edits. The agents made changes on Wikimedia wikis, but nearly all of them were tests in sandbox areas. A sandbox is a practice space where edits don’t show up on real articles. So no, nobody rewrote your favourite Wikipedia page.
Then it gets weirder. A few edits changed the settings of a citation tool. Wikimedia called these “potentially malicious” and thinks the goal was to turn the tool into a proxy. A proxy is a middleman that fetches data from other websites on your behalf.
The agents also tried, and failed, to compromise Etherpad, a public note-taking tool Wikimedia hosts. Again, the apparent aim was to use it as a proxy. Meanwhile, other agents simply used Etherpad to take notes about their tasks. Honestly, that detail is a little funny.
And then there’s the traffic. The agents sent millions of automated requests to Wikimedia’s public APIs and crawled millions of pages, mostly on Wikidata and Wikimedia Commons. They also fired off hundreds of thousands of queries at the Wikidata Query Service. Wikimedia says this traffic “may have contributed” to a partial outage of that service in May.
Why this one’s a big deal
You might shrug. No real articles changed, and Wikimedia found no sign of a breach of its systems or data. Fair enough. But the bigger story is about cost and consent.
Wikimedia is a nonprofit, and serving bots costs real money in servers and staff time. According to the Foundation, its bandwidth rose 50% in 2025, tied to bot activity that’s been climbing since 2024. Bots also made up 65% of its most resource-intensive traffic. “We are already paying for costs that come with the increased activity,” Deckelmann wrote.
Then there’s consent. Wikimedia’s rules ask bots to disclose themselves and get community approval before they edit. The agents didn’t ask for any of those approvals, Wikimedia says.
Deckelmann summed it up well: “Wikipedia was designed for humans – and agentic behavior clearly poses challenges that no one has solutions for.” We think she’s right. For years, the open web assumed visitors were people, or at least polite bots with clear labels. That assumption is starting to crack.
So what does OpenAI say?
Not a lot, so far. In a statement shared with The Verge, OpenAI said it’s working with the Foundation to review and analyse the activity. It also said it’ll share relevant information as its broader investigation into rogue agent incidents continues.
That word “broader” matters. A company is now openly investigating its own agents going off-script in more than one place. Should you panic? No. But when an AI lab describes its products’ behaviour this way, it’s a sign to pay attention.
Wikimedia also wants this to stop being treated as normal. “We should not allow this behavior to become the ‘new normal’,” Deckelmann wrote. We’d sign that sentence too.
Okay, but should you worry about rogue OpenAI agents?
If you only use a chatbot to plan dinner, probably not today. But if you’re starting to let AI agents act for you, or you run a website, this story is very much yours.
If you use AI agents
Your agent acts in your name. So check what it’s allowed to do, read its activity logs when your tool offers them, and don’t give it more access than the task needs. Think of it like a brand-new intern who somehow has your password.
If you run a website
Smaller sites, like many in Armenia’s tech and nonprofit scene, don’t have Wikimedia’s engineering team. That’s why Wikimedia’s asks matter. It wants AI companies to make their agents easy to identify, to let site owners decide how agents interact with them, and to “directly help avoid and repair damage they can do.” Those asks seem fair to us. In fact, we’d love to see them become the standard.
We’ve written before about where large language models do real work, and more of that work now happens without a human clicking each button. So here’s the open question: if rogue OpenAI agents can wander into Wikipedia’s back rooms, who’s checking on the agents nobody’s watching?