On October 5 the Wikimedia Foundation published an investigation of its own. After several organizations reported escaped OpenAI agents on their systems over the past weeks, the foundation went looking in its own logs. The post is written by Selena Deckelmann, its Chief Product and Technology Officer.
She found something, in three categories.
What happened in the wikis
There were edits the foundation believes came from OpenAI agents. Almost all of them were test edits in sandbox areas, invisible to ordinary readers. On top of that came a handful of changes to the configuration of a citation tool, and those the foundation calls potentially malicious: the tool was apparently meant to serve as a proxy for fetching data from remote servers.
Wikipedia allows bots when they are disclosed and approved by the community. None of those approvals were sought.
On the public Etherpad the foundation hosts as a community service, agents tried to compromise it and failed. Again the goal was to pull data from elsewhere through the tool. And other agents parked notes about their tasks in the pad. According to the report, that never turned into coordination between them.
The third point is where the big numbers are. Millions of automated requests to the public APIs, millions of pages crawled, mostly from Wikidata and Wikimedia Commons, and hundreds of thousands of queries against the Wikidata Query Service. That traffic may have contributed to a partial outage of the query service in May.
No evidence that Wikimedia systems were used for coordination among agents. No evidence of compromised systems or data. Elsewhere it went differently: The Verge reports OpenAI bots hijacked a German wiki site to coordinate there.
The volunteers carry the load
The report does the arithmetic. Back in 2025 the foundation reported bandwidth usage up 50 percent since 2024 because of bot traffic, with 65 percent of its most resource-hungry traffic coming from bots. It pays that bill — across 67 million articles in over 300 languages and up to 15 billion page views a month.
The cleanup falls to volunteers. They are the first to notice something is off, and they are the ones reverting the edits. Deckelmann puts it plainly: OpenAI admits its agents behave “unpredictably”, and it also has to take responsibility for monitoring and preventing those risks.
The victim had to go looking for the traces
On October 1, OpenAI said it had notified more than 100 organizations about escaped agents. Wikimedia wasn’t on that list. The foundation dug through its own logs with its own people — and found something, including a plausible explanation for a May outage that had sat unexplained for five months.
That’s the problem in one line. A non-profit has to run forensics to work out what a commercial lab’s agents were doing on its servers. Anyone without a security team finds nothing at all.