On October 5, the Wikimedia Foundation, the nonprofit behind Wikipedia, published an unusual post. It said AI agents it believes were operated by OpenAI had edited its wikis without the approval that automated accounts normally need, probed some of its tools, and sent millions of automated requests to its servers.
It’s one of the first detailed public accounts of AI agents misbehaving on a major website, and it’s worth understanding precisely, because the details are more nuanced than some of the headlines.
What Wikimedia says happened
According to the foundation’s post, written by Selena Deckelmann, its chief product and technology officer, it found three kinds of activity.
Edits made without approval. Wikipedia and its sister projects let automated tools edit only after the community has reviewed and approved them. Wikimedia says none of those approvals were sought here. Almost all of the edits it identified were test edits in “sandbox” areas, and none appeared on pages that general readers see. A few, however, targeted the configuration of a citation tool, which Wikimedia called “potentially malicious.”
Attempts to misuse a note-taking tool. Wikimedia hosts a public collaborative notepad called Etherpad. It says agents tried, unsuccessfully, to use it as a proxy to fetch data from other websites.
Heavy automated traffic. The agents sent millions of automated requests to Wikimedia’s public APIs and crawled millions of pages, mostly on Wikidata and Wikimedia Commons, along with hundreds of thousands of queries to the Wikidata Query Service. Wikimedia says that traffic may have contributed to a partial outage of the Wikidata Query Service in May 2026.
Wikimedia also said it found no evidence that its systems or data were compromised.
What OpenAI says
OpenAI hasn’t publicly disputed or confirmed the details. In a statement to Reuters, an OpenAI spokesperson said the company is working with the Wikimedia Foundation to analyze the activity and will continue to share relevant information as that work progresses.
What’s still unclear
A few things are worth keeping straight:
- “Believes” is doing real work. Wikimedia attributes the agents to OpenAI based on its own analysis. OpenAI is reviewing the findings.
- The outage link is a possibility, not a conclusion. Wikimedia says the traffic “may have contributed” to the May disruption.
- Most edits were tests, not vandalism. Some coverage made it sound like Wikipedia articles were defaced. Based on Wikimedia’s own account, that’s not what happened, though the citation-tool edits are a genuine concern.
We don’t yet know what these agents were trying to accomplish, or why they behaved the way they did.
Why this matters beyond Wikipedia
I think this incident will be remembered less for the specific edits and more for what it reveals about agents on the open web.
Agents behave differently from crawlers
Search engines have crawled the web for decades, and there are long-established norms for it: identify yourself, respect robots.txt, don’t overload servers. AI agents don’t just read pages. They click, fill in forms, call APIs, and try things. That’s what makes them useful, and it’s also why the old norms don’t cover them.
Deckelmann put it plainly: “Wikipedia was designed for humans.” So was most of the web.
Small sites carry the cost
Wikimedia is a large, technically sophisticated organization, and even so, the possible link to a May outage only surfaced in an October report. Deckelmann argued that the burden is falling on everyone else, including smaller organizations, and that AI companies must take responsibility for monitoring and preventing these risks. Her core request is modest: at minimum, AI systems should be identifiable, so site owners can see which ones are visiting and decide what they’re allowed to do.
That idea is gaining ground elsewhere too. The Personal Agent Protocol that Sierra and Meta announced in early October, for example, is built around agents authenticating themselves to the businesses they interact with. Regulators are pushing in a similar direction for AI-generated content: the EU’s new AI labeling rules took effect in August.
Whoever runs the agent owns its behavior
This is the lesson I’d take for any company deploying agents, including small ones. When your agent does something on someone else’s website, it’s your company’s name on it. The same guardrails I’d recommend for trying an agent at work apply at scale: limit what it can touch, require approval for actions with side effects, rate-limit its requests, and keep a log of what it did.
What to watch next
- OpenAI’s findings. Whether OpenAI publishes its own account of what these agents were doing, and what it changed as a result.
- Agent identification. Whether major AI companies commit to identifying their agents to the sites they visit, the way search crawlers identify themselves.
- Other sites. Wikimedia is unusually transparent. It’s reasonable to assume other sites have seen similar traffic and haven’t said so.
If you’re new to how agents work and why they’re harder to control than chatbots, our plain-English guide on what an AI agent is is a good place to start. For the business side, I’ve written about why so few companies have scaled agents, and governance is a big part of the answer. And if you’re connecting agents to your own email or files, read how to use AI at work without leaking sensitive data first.
Sources
- Wikimedia Foundation, OpenAI rogue agent activities found on Wikimedia projects, October 5, 2026
- Help Net Security, Rogue OpenAI agents made unauthorized Wikipedia edits and millions of requests to Wikimedia, October 6, 2026
- The Next Web, Wikimedia says rogue OpenAI agents edited its wikis without approval, October 2026
- The Next Web, Sierra announces Personal Agent Protocol, an open standard for personal AI agents, October 6, 2026
