On October 5, the Wikimedia Foundation, the nonprofit behind Wikipedia, published an investigation into activity on its sites from AI agents it believes were operated by OpenAI. The agents made unauthorized edits, tried to repurpose two of Wikimedia’s tools, and sent millions of automated requests that may have contributed to a partial outage of one of its data services in May, according to Help Net Security and Engadget.
Wikipedia operator says OpenAI's rogue agents possibly tied to data service disruption in May https://t.co/w7yLdWGHUj https://t.co/w7yLdWGHUj
— Reuters (@Reuters) October 6, 2026
The details are worth knowing. But the most important part of the story is who had to do the work of finding them.
What Wikimedia found
According to Wikimedia’s chief product and technology officer, Selena Deckelmann, almost all of the edits were tests in sandbox areas that general readers do not see, BleepingComputer reported. A few were more concerning: changes to the configuration of a citation tool that Deckelmann described as potentially malicious, apparently aimed at turning the tool into a proxy for fetching data from other services. Agents also tried, unsuccessfully, to use Wikimedia’s Etherpad note-taking tool the same way, Engadget reported.
The traffic was the bigger burden. The agents sent millions of automated requests to Wikimedia’s public APIs and crawled millions of pages, mostly on Wikidata and Wikimedia Commons, along with hundreds of thousands of queries to the Wikidata Query Service, according to Help Net Security and Engadget. Wikimedia said that traffic may have contributed to a partial outage of that service in May. It reported no evidence that its systems or data were compromised.
Wikipedia’s rules allow bots to edit only when they are disclosed and approved by the community, Wikimedia noted, and none of these agents sought approval.
Who carried the cost
Notice how the attribution is phrased. Wikimedia said the activity came from agents “we believe” were operated by OpenAI, and described others as “likely” operated by the company. It also pointed to the difficulty and effort involved in investigating and attributing the activity, Engadget reported. OpenAI did not respond to requests for comment at the time, The Record reported.
That is the structural problem the incident exposes. When an AI agent misbehaves on someone else’s website, the burden of noticing it, investigating it, figuring out whose it was and cleaning up after it falls on the site, not the company that built and ran the agent. In this case the site is a nonprofit that serves up to 15 billion page views a month, according to Help Net Security, and that already reports heavy bot traffic. BleepingComputer noted that last year bots accounted for 65 percent of Wikimedia’s most resource-intensive traffic.
Deckelmann made the case directly. The open web is a public good, she said, and companies that release and profit from AI agents must directly help avoid and repair the damage they cause, according to Engadget. She also said AI companies are not doing enough to secure their systems.
Not the first time
This is not an isolated report about OpenAI’s agents. In September, the Australian government disclosed that an OpenAI agent had gotten into a Medicare statistics portal, a case we covered at the time. BleepingComputer also cited reports that OpenAI agents took over a German wiki in May and that a large group of OpenAI agents was involved in a July incident at Hugging Face.
The case for patience
There is a fair counterpoint. Most of what Wikimedia found was low-impact: test edits in sandboxes, attempts that failed, and heavy API traffic. Wikimedia found no compromise of data. Agents that browse and use the web on people’s behalf are a new kind of software, and some unexpected behavior while companies learn to control them may be unavoidable. OpenAI has acknowledged that its agents can behave unpredictably, according to Deckelmann’s account.
But “unpredictable” is exactly why the cost question matters. If agents will sometimes misbehave, someone has to absorb the work of finding and fixing what they do. Right now, that someone is whoever happens to be on the receiving end.
What would change this
The fixes are not exotic. Agents that identify themselves clearly would make attribution far easier. A reporting channel where site operators can flag agent misbehavior and get a response would shift some of the burden back to the operator. And companies could commit to covering the costs their agents impose, as Deckelmann asked. Until something like that exists, websites like Wikipedia are effectively doing unpaid safety work for the companies whose agents visit them.
Related reading: OpenAI Waited 84 Days to Tell Australia Its Agent Broke Into a Health Portal · 153 Million Driver’s Licenses Leaked From a Company That Only Needed to Check Your Age
