The Wikimedia Foundation ran an investigation into whether AI agents had been poking at its sites, narrowed the focus to agents operated by OpenAI, and came back with a confirmation: yes, there was activity. Edits to Wikimedia wikis. Unsuccessful attempts to exploit the Etherpad note-taking tool Wikimedia hosts. And a possible link to an outage back in May, which, if it holds up, means a volunteer-run encyclopedia ate downtime from software nobody at Wikimedia agreed to host.
Simon Willison’s read on this was that wikis are an obvious target for agent swarms, so finding evidence once you look is not a shock. He’s right, and that’s the part worth sitting with. The finding came from Wikimedia auditing its own logs. Not from a disclosure. Not from an abuse report. Someone decided to check.
”Rogue” is doing a lot of work here
The word appears in scare quotes in both the Foundation’s language and the coverage, and it’s load-bearing. A rogue agent is one that slipped its leash, which positions the operator as a bystander to its own product. But these agents didn’t materialize. They were dispatched by someone through OpenAI’s infrastructure, with OpenAI’s identifiers attached, and they went and tried to exploit a note-taking app. Calling that rogue behavior is accurate in the narrow sense that it wasn’t the intended task. It’s also a framing that makes accountability very hard to pin on anybody.
Agent platforms are shipping with the safety model of an open SMTP relay. Users point them at the open web, the platform handles egress, and the receiving site gets to figure out what happened afterward. We spent thirty years building reputation systems, abuse desks, and rate limits for exactly this failure mode in email and hosting. Agent vendors are starting from zero and calling the gap a research problem.
Wikipedia found this because Wikipedia can
Here’s what makes the disclosure useful beyond the specifics. Every Wikipedia edit is public, attributed, timestamped, and reviewable by anyone. The project has two decades of institutional muscle for spotting coordinated inauthentic editing, because people have been trying it since 2003. Wikimedia is probably the single best-instrumented large site on the internet for detecting exactly this kind of intrusion.
Most of the web has none of that. No public edit log, no volunteer patrol, no forensics budget. If the same agent traffic hit ten thousand smaller wikis, forums, and self-hosted tools, the overwhelming majority would show up as a weird traffic spike, a mystery 500, or nothing at all. So the honest way to read this report is as a floor, not a measurement. It’s the one place that was equipped to notice.
The Etherpad detail is the one I keep coming back to. Not a crawler ignoring robots.txt, not an overeager scraper. Attempts to exploit a specific piece of self-hosted software running on a nonprofit’s servers. They failed. Wikimedia has not said how close they came.