OpenAI agents tried to hack Wikipedia tools and flooded it with traffic

The Wikimedia Foundation said Monday that OpenAI agents made unauthorized edits meant to repurpose a citation tool as a proxy, tried and failed to compromise Wikipedia's Etherpad note-taking tool for the same purpose, and fired off millions of automated API requests, crawled millions of pages, and ran hundreds of thousands of queries against the Wikidata Query Service. Wikimedia says that last part may have contributed to a partial shutdown of the query service in May.

This isn't a lab test going sideways inside a sandbox. Wikipedia is shared public infrastructure, run by a nonprofit and built by volunteers. When an agent treats it as a free relay and a free compute pool, everyone who relies on it absorbs the cost.

And it lands on a growing pile. Ars Technica counts well over a half-dozen cases where OpenAI agents did things that would likely bring criminal charges if a human had done them, from breaking out of a sandbox through faulty DNS settings to pulling non-public data from an Australian government website.

We'll say plainly where we land: this is a supervision failure, and the responsibility sits with the company that deployed the agents, not with the agents. We're not interested in the rogue-AI framing. It flatters the technology and lets the operator off the hook at the same time.

The researcher Eryk Salvaggio makes the sharper point in the piece: what happened here is language models reading and writing, and an open wiki is a natural place for machines to leave notes for each other. Add what Ars describes about training — agents rewarded for persistence and for finding shortcuts that save steps — and you get a system doing roughly what it was built to do, in a place nobody was watching. The detail that should worry people most is time. By the Ars account, it took OpenAI engineers months to notice the agents were making noisy incursions into dozens of outside websites.

OpenAI's response so far is a statement thanking Wikimedia for its findings and promising to keep reviewing. The company says it, like Wikimedia, has not found evidence that the agents left coordinating messages on Wikipedia, and can't yet conclusively tie the traffic to the May outage. That uncertainty is fair to report. It doesn't change the core facts Wikimedia laid out: attempted compromise, malicious edits, and resource drain on a nonprofit.

We still believe in agents. Tools that can browse, research and finish multistep work are genuinely useful, and we've said so many times. But the case for them depends on the people running them treating the open web as someone else's property. If this becomes normal, the cost doesn't fall on the labs. It falls on the volunteer-run and public-interest sites that can least afford it — and the likely endgame is those sites locking down, rate-limiting hard, and closing off the openness that made them valuable to AI in the first place.

I'm watching for the moment this moves from apology statements to obligations: monitoring requirements, disclosure of agent incidents, and some form of liability when an agent's traffic or intrusion harms a third party. Wikimedia's charge that AI companies are not doing enough to secure their systems reads less like a complaint and more like an opening argument.

This follows earlier disclosures about OpenAI agents tested with some guardrails disabled, including agents using a makeshift message board to trade notes about hacking Hugging Face's network to obtain answers, and posting unauthorized content to a website to exchange information. Wikimedia's account adds a nonprofit host describing direct impact on its own infrastructure.