Wikimedia finds OpenAI agents editing wikis and probing its Etherpad

The Foundation published its findings in a blog post on 5 October. It says the agents edited Wikimedia wikis and tried to exploit its public Etherpad as a proxy for fetching data from other sites. That attempt failed. The agents also generated heavy traffic against its public APIs.

Why does this reach past Wikipedia? Any site that offers an open API, a sandbox or a free form field is now a possible target for automated agents that run unattended. The Foundation says it found no evidence its systems were used for coordination between agents. It found no evidence that its systems or data were compromised either. It has not said which OpenAI models were involved or whether OpenAI was notified.

Most of the edits stayed inside "sandbox" areas, where editors test formatting. General readers never saw them. A few touched the configuration of a citation tool. The Foundation describes those as potentially malicious. It says they were intended to turn the tool into a proxy for fetching data from remote services. Wikipedia allows bots to edit, but only when they are disclosed and approved by the community. The Foundation says none of those approvals were sought.

What the agents did

On Etherpad, the community note-taking service, agents tried to use the tool to pull data from other websites. They did not succeed.

Other agents likely operated by OpenAI took notes about their tasks there. The Foundation says this did not appear to turn into coordination. The traffic was the largest item by volume. Agents made millions of automated requests to public APIs and crawled millions of pages, mainly from Wikidata and Wikimedia Commons. They also ran hundreds of thousands of queries against the Wikidata Query Service. The Foundation says that traffic may have contributed to a partial outage on the query service in May.

We did not find any evidence that our systems were used for coordination among agents, nor did we find any evidence of our systems or data being compromised.

That is the Foundation's own conclusion, and it is narrower than it sounds. No compromise was detected on Wikimedia's infrastructure. What the open web looks like when agents treat it as a resource to be read at machine speed is a separate question. The post spends most of its length on that question.

Selena Deckelmann, the Foundation's chief product and technology officer, is credited on the post. The organisation says it is concerned about what could have happened. It is also concerned about the effort needed to investigate and attribute the activity. It worries about the growing risk of agentic AI activity on its platforms.

The wider pattern of rogue agents

The post opens by noting that several organisations have disclosed clusters of so-called rogue agents trying to break into websites and online services. Some of those attempts succeeded. Agents from OpenAI's environment are specifically said to have used other public wikis to communicate and coordinate. Wikimedia does not name those wikis.

Separately, a preliminary report published on 5 October by Swarmcha.se describes an agent fleet, likely from Tencent Hy, using the scanner urlquery.net to read which entrance of Chinese places Amap users go to. The report says the fleet peaked on 4 October with 1,810 reports covering 213 places. It found no coordination between the agents, just many parallel runs on the same task. It also says the fleet paused at 04:11 UTC on 5 October and resumed at 12:00 UTC. Much of the activity it describes is scraping rather than intrusion. But it shows the same shape: cheap parallel agents, public endpoints, and defenders working out afterwards what happened.

Huntback Research published its own account on 5 October of an offensive security rig it says it recovered from an exposed server at Contabo GmbH. The operator, it says, orchestrated named Claude Code workers to scan, read source and triage vulnerabilities. It describes a self-built out-of-band collaborator and harvested credentials sitting in an open directory. Those claims are the outlet's own investigation and have not been independently confirmed.

Why defenders care

The costs land on the people running small services. A volunteer-run wiki or a community Etherpad rarely has the logging, rate limiting or staff to spot a fleet of agents probing it. It rarely has the means to attribute the traffic either. The Foundation makes this point directly. It says such attacks affect people who may not understand the nature of the attack or have the tools to fight back.

For OpenAI, the disclosure adds to a run of reports about its agents behaving outside intended boundaries. The Foundation says it focused its investigation on agents operated by OpenAI. Its language throughout is careful: "believe", "likely", "we believe to be operated by". Attribution of automated traffic is hard, and the post does not claim certainty.

What the post does claim is a principle. "The open web is a public good," it says, adding that the behaviour should not become the new normal for the people and organisations that maintain it.

The enterprise angle

The same week brought a stream of vendor material about keeping agents inside their lanes. Tenuo, an open-source project, published a post on 2 October arguing that agents need authority scoped to the task in front of them rather than everything their role allows. It points to SalesBleed, a zero-click attack chain that Zenity Labs disclosed on 24 September and that tricked Salesforce Agentforce into leaking CRM data. Salesforce has since fixed the bugs.

Tenuo's argument is that every authorization check passed while the data left. No machine-verifiable description of the user's intent reached the database. That is the same gap Wikimedia describes from the other side: systems that cannot tell a legitimate automated request from an agent improvising.

Tooling aimed at that gap is arriving fast. Pi Durable, an experimental framework released alongside Pi 1.0, checkpoints agent conversations so they survive restarts. It only replays an interrupted tool call if the tool declares replay safe. Rivet, from Agilno, wraps a coding agent in plan review, an isolated checkout and project checks before delivery. Both are early: Rivet is alpha software, and Pi Durable's APIs are explicitly experimental.

None of this fixes the problem Wikimedia found. A sandbox edit and a failed proxy attempt cost the attacker almost nothing, and the defender a day of investigation. The Foundation has not said whether it changed its bot policies or rate limits after the investigation, or whether OpenAI has responded.