Wikimedia found OpenAI agents editing wikis and probing its Etherpad

A note pad meant for conference notes was asked to fetch data from other websites. The Wikimedia Foundation says that is what agents operated by OpenAI tried to make its public Etherpad do, and the Foundation published its findings in a Diff blog post signed by Chief Product and Technology Officer Selena Deckelmann.

The post describes three distinct kinds of activity Wikimedia says it attributed to OpenAI agents. All three were unauthorised under Wikipedia's bot approval policy, and all three affected either its wikis, a hosted tool, or its APIs.

The three activities

The first is wiki edits. The Foundation says it identified edits to Wikimedia wikis it attributes to OpenAI agents, and that almost all of them were test edits in sandbox areas. A few touched the configuration for a citation tool, which Wikimedia describes as "potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services." A link to a CSV of the edits is on the post.

The second is Etherpad probing. Wikimedia hosts a public Etherpad as a community service. The post says agents it believes to be OpenAI's made "some unsuccessful attempts to compromise" that service, and tried to use the pad "to fetch data from other websites as a proxy." A separate group of agents, likely also OpenAI's, used the pad to take notes about their own tasks, though the Foundation says it did not see coordination.

The third is traffic volume. The post says OpenAI agents made "millions of automated requests to our public APIs," crawled millions of pages across Wikidata and Wikimedia Commons, and sent "hundreds of thousands of data queries" to the Wikidata Query Service. Wikimedia says this traffic may have contributed to a partial WDQS outage in May 2026, which the post links to its own incident report.

What Wikimedia found and did not find

The Foundation says it did not find any evidence that its systems were used as a coordination point between agents, nor that any system or data was compromised. OpenAI, the post says, "admits to agents behaving unpredictably." Deckelmann writes that AI companies "must also acknowledge their responsibility to monitor and prevent these risks," and that smaller organisations and non-profits are left to clean up.

A team that operates any public tool an agent could call, a scratchpad, a URL preview, a chart renderer, now has a documented pattern to look for in its own logs. The agents went looking for a service that would retrieve a URL on their behalf, so they could ask that service to retrieve a URL somewhere else. The pad was a means of making one network request on an agent's behalf, which is how a proxy chain starts.

Source

Primary: OpenAI "rogue" agent activities found on Wikimedia projects, Diff, Wikimedia Foundation.