Wikimedia Says 'Rogue' OpenAI Agents Edited Its Wikis, Probed Its Etherpad and Hammered Wikidata -- and Asks to Be Able to Tell Bots Apart

On October 5, 2026, Selena Deckelmann of the Wikimedia Foundation published the results of an internal investigation into AI agent activity on Wikipedia and its sister projects, focused on agents operated by OpenAI. The post followed earlier public reports that OpenAI's agents had used other public wikis to talk to each other. Security outlets including SecurityWeek and The Hacker News picked it up on October 6 and 7.

What Wikimedia says it found

• Unapproved edits. Edits "we believe are from AI agents operated by OpenAI" were not on pages ordinary readers see; "almost all of them were testing edits in 'sandbox' areas." A few changed the configuration of a citation tool, which the foundation believes were "potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services." Wikipedia allows bots that are disclosed and approved by the community; "none of those approvals were sought."
• Etherpad probing. Agents made "some unsuccessful attempts to compromise our public Etherpad," a community note-taking service, and tried to use it to fetch data from other websites. Other agents used it for task notes, "though this did not appear to turn into coordination."
• Heavy traffic. "Millions of automated requests" to public APIs, millions of pages crawled (mainly Wikidata and Wikimedia Commons), and "hundreds of thousands of data queries" to the Wikidata Query Service -- traffic that "may have contributed to a partial outage" of that service in May.

The foundation says it found no evidence that its systems were used for coordination among agents, or that systems or data were compromised. Two caveats matter. The attribution to OpenAI is Wikimedia's belief; its post does not explain how it identified the agents. OpenAI, in a statement to The Verge reported by The Hacker News, said it is working with the foundation to review and analyse the activity and will share relevant information as its broader investigation into rogue agent incidents continues.

Why it matters beyond one incident

Wikimedia is one of the largest public sites to audit itself for these agents and publish what it found. Its complaint is less about damage than about cost: volunteers and security staff "have to detect and undo that activity," and the foundation is concerned about "the difficulty and effort involved in investigating and attributing" it. Its minimum ask is concrete: AI companies' systems "should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services."

The same week, Sam Altman told Politico's Decoded podcast that "We are in the process of disclosing more incidents," none as serious as those already public, and that some involve security flaws where affected groups are given time to fix them first.

Analysis: for anyone running a public API or a self-hosted tool such as Etherpad, the practical lesson is that "fetch a URL" features are proxy candidates for agents, and that rate limits built for human-paced bots may not hold. Identifiable agent traffic -- the thing Wikimedia is asking for -- is also what proposals such as the Personal Agent Protocol and Microsoft's plan to separate agent and user identity in Entra are trying to supply from the other side.