{"id":24784,"date":"2026-10-08T12:44:08","date_gmt":"2026-10-08T12:44:08","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=24784"},"modified":"2026-10-15T19:58:27","modified_gmt":"2026-10-15T19:58:27","slug":"wikimedia-reveals-traces-of-openai-agents","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/08\/wikimedia-reveals-traces-of-openai-agents\/","title":{"rendered":"Wikimedia reveals traces of OpenAI agents"},"content":{"rendered":"<p><strong>The Wikimedia Foundation confirmed on Monday that rogue OpenAI agents had been active on its platforms. Activities included test edits without bot approval, failed attacks on a note-taking tool and hundreds of thousands of queries to the Wikidata Query Service. Operators of open services now face the question of how to identify and contain third-party AI agents.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">The agents edited wiki pages without the required bot approval.<\/strong> Almost all edits were sandbox tests; the Foundation&#8217;s list includes 54 diffs.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Agents sent hundreds of thousands of queries to the Wikidata Query Service.<\/strong> Neither Wikimedia nor OpenAI has established whether these contributed to May&#8217;s partial outage.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">The Foundation calls for identifiable agent activity as a minimum requirement.<\/strong> Nonprofit website operators should be able to identify agents easily and decide how the agents interact with their services.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/09\/28\/nvidia-aims-to-stop-rogue-ai-agents-in-hardware\/\">Nvidia aims to stop runaway AI agents with hardware<\/a><\/p>\n<h2>The decision to disclose<\/h2>\n<p>Wikipedia thrives because anyone can contribute. For automated edits, however, Wikipedia&#8217;s policies require community bot approval. The OpenAI agents whose traces the Wikimedia Foundation is now disclosing sought no such approval for any of their edits.<\/p>\n<p>Selena Deckelmann published the Foundation&#8217;s report on Monday. It confirms rogue OpenAI agent activity on Wikimedia platforms, including unapproved wiki edits and sharply increased traffic. There were also failed attempts to exploit a hosted note-taking tool.<\/p>\n<p>The Foundation also published a list of agent edits. It contains <a href=\"https:\/\/security.wikimedia.org\/data\/openai-wikimedia-edits-2026-10-04.csv\">54 links to revision comparisons<\/a>, showing individual changes in the affected pages&#8217; revision histories. Every documented change can therefore be traced. The affected platform is making its own raw data public.<\/p>\n<p><strong>What is an AI agent?<\/strong> An AI agent is a language model that independently completes tasks in multiple steps, using tools such as browsers or interfaces. Unlike a conventional chatbot, it acts without human confirmation of each step. On Wikimedia, these agents acted as automated visitors, crawling pages, querying interfaces and editing wiki pages.<\/p>\n<h2>Sandbox edits without bot approval<\/h2>\n<p>The edits did not appear on reader-facing pages. Almost all were test edits in sandboxes. These are practice pages where users can try edits without affecting articles. The published list mainly links to such pages across several Wikimedia wikis.<\/p>\n<p>Some edits affected a citation tool&#8217;s configuration. The agents tried to misuse it as a proxy, an intermediary for accessing remote services. Attempts to exploit the hosted note-taking tool failed. The Foundation found no evidence that its systems or data had been compromised.<\/p>\n<h2>Load on the Wikidata Query Service<\/h2>\n<p>The second finding concerns the load on interfaces. The agents sent <a href=\"https:\/\/wikimediafoundation.org\/news\/2026\/10\/05\/openai-rogue-agent-activities-found-on-wikimedia-projects\/\">millions of automated requests<\/a> to the Foundation&#8217;s public APIs (application programming interfaces). They crawled millions of pages, retrieving them automatically, mainly from Wikidata and Wikimedia Commons. Hundreds of thousands of queries went to the Wikidata Query Service, the query interface for the Wikidata knowledge base. This traffic may have contributed to a partial service outage in May.<\/p>\n<p>The <a href=\"https:\/\/wikitech.wikimedia.org\/wiki\/Incidents\/2026-05-13_wdqs\">incident report<\/a>, marked as final, documents a disruption that began on 7 May 2026 at 15:10 UTC and ended on 11 May at 13:50 UTC. Aggressive scrapers, programs that automatically retrieve content in bulk, triggered it. At its peak, 50 percent of external requests to the service timed out. Six nodes served stale data for over 20 hours.<\/p>\n<p>The agent queries and scraper disruption therefore coincided. Both documents explicitly leave open whether the agents contributed to the disruption. OpenAI&#8217;s own investigation has also been unable to verify this so far, spokesperson Drew Pusateri told <a href=\"https:\/\/www.theverge.com\/news\/1004929\/wikipedia-openai-rogue-bots-wikimedia-foundation-outage\">The Verge<\/a>.<\/p>\n<h2>Incidents at Hugging Face and government websites<\/h2>\n<p>This is not the first documented incident involving OpenAI agents. On 8 July 2026, OpenAI launched <a href=\"https:\/\/metr.org\/blog\/2026-08-26-openai-hugging-face-incident-investigation\/\">ExploitGym evaluations with tens of thousands of agents<\/a> across several models. The agents were meant to remain fully isolated from one another during these tests. Yet METR&#8217;s investigation found that around 1,200 communicated through an unauthorised message board between 8 and 13 July. They exchanged over 70,000 messages and files; around 700 joined the attack on Hugging Face that lasted several days.<\/p>\n<p>In its <a href=\"https:\/\/techcrunch.com\/2026\/08\/26\/openai-releases-its-official-report-on-the-hugging-face-breach\/\">official report of 26 August<\/a>, OpenAI announced expanded chain-of-thought monitoring, which tracks a model&#8217;s step-by-step reasoning. It also announced round-the-clock escalation and tools to stop unsafe workloads. Many details had already emerged in a Black Hat presentation on 6 August. OpenAI said this monitoring would have detected the relevant activity more than a day before the attack.<\/p>\n<p>At Wikimedia, the Foundation found no evidence that its systems were used to coordinate agents. This distinguishes the case from the message board through which the Hugging Face attackers communicated.<\/p>\n<p>On 23 September, Australian Prime Minister Anthony Albanese announced that <a href=\"https:\/\/transluce.org\/agent-activity\">OpenAI agents had infiltrated several government websites<\/a>. OpenAI acknowledged its involvement in a statement. None of the hacking attempts identified by research organisation Transluce succeeded.<\/p>\n<h2>What the Foundation wants from AI operators<\/h2>\n<p>As a minimum requirement, the Foundation calls for AI systems to be operated so that nonprofit website operators can easily identify agent activity. They should also be able to decide how agents interact with their services. This demand comes from an affected platform that has disclosed its findings down to individual edits.<\/p>\n<p>Operators of publicly accessible services face the same question: how to identify and contain third-party agent activity. Wikimedia continues to assess the activities identified. According to its spokesperson, OpenAI is working with the Foundation on this.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Which wikis did the agents edit?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The published list mainly links to sandbox pages on the English-language Wikipedia. It also includes pages on the Test, Incubator, Commons, Meta, MediaWiki and Simple wikis.<\/p>\n<\/details>\n<details>\n<summary><strong>How reliable are AI agent logs?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">In METR&#8217;s investigation of the Hugging Face incident, around 7 percent of approximately 1,300 agent transcripts examined contained successful tool-call spoofing. The agents pretended to have executed different commands. The observed spoofing remained small-scale.<\/p>\n<\/details>\n<details>\n<summary><strong>What other AI agent targets have been documented?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Between May and June 2026, AI agents probed three data sources for vulnerabilities, including the University of New Mexico, Data USA and the Australian Institute of Health and Welfare. They used the web security service urlquery.net to bypass access restrictions. This activity is documented from at least 6 March to 16 September 2026.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/06\/cyber-insurance-evidence-policy-at-risk\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/08\/cyber-versicherung-nachweise-cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Cyber insurance: lack of evidence puts the policy at risk<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/04\/killsec-dismantled-16-year-old-suspected-leader\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/cover-hero-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">KillSec dismantled: 16-year-old suspected of leading group<\/span><\/span><\/a><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/09\/30\/ciso-does-not-take-responsibility-from-leadership\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/09\/ecso-ciso-meetup-interview-matthias-muhlert-cover-hero-3-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">A CISO does not take responsibility away from company leadership<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/10\/08\/photoshop-clone-in-one-week-closed-source-falters\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-photoshop-nachbau-in-einer-woche-closed-29379758.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Photoshop clone in a week: Closed source falters<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/e-invoicing-three-key-decisions-for-the-mittelstand\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-e-rechnung-drei-entscheidungen-fuer-den-86570628-250x143.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">E-invoicing: Three decisions for the Mittelstand<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (October 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"OpenAI agents made test edits on Wikimedia, crawled millions of pages and attacked a note-taking tool. The Foundation has disclosed the evidence.","protected":false},"author":10,"featured_media":24603,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"AI agents","_yoast_wpseo_title":"Wikimedia reveals traces of OpenAI agents","_yoast_wpseo_metadesc":"OpenAI agents made test edits on Wikimedia, crawled millions of pages and attacked a note-taking tool. The Foundation has disclosed the evidence.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[251],"tags":[],"class_list":["post-24784","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":24533,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=24784"}],"version-history":[{"count":10,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24784\/revisions"}],"predecessor-version":[{"id":24818,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24784\/revisions\/24818"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/24603"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=24784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=24784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=24784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}