The Wikimedia Foundation says AI agents believed to be operated by OpenAI attempted to manipulate some of its public tools into acting as proxies for retrieving information from other websites.
The activity did not result in a known compromise, but it adds to a growing collection of incidents in which autonomous AI systems have behaved in unexpected ways while pursuing their assigned objectives. For Wikimedia, the bigger concern is that website operators are increasingly being forced to investigate and defend against automated behavior they did not authorize and can struggle to attribute.
Agents Tried to Repurpose Wikimedia Tools
Wikimedia investigated its infrastructure after reports of unusual OpenAI agent behavior on other websites. It discovered agents making edits across Wikimedia-hosted wikis, although almost all were harmless tests performed in sandbox areas and never appeared on pages visible to ordinary Wikipedia readers.
A small number were more concerning. Agents modified configuration associated with a citation tool in what Wikimedia believes may have been an attempt to turn the service into a proxy capable of retrieving information from remote systems.
Agents also targeted Wikimedia’s public Etherpad service, a collaborative note-taking platform used by its community. According to the foundation, they unsuccessfully attempted to make Etherpad fetch information from external websites on their behalf.
Other likely OpenAI agents simply used Etherpad to record notes about tasks they were performing. Wikimedia found no evidence that the service was successfully transformed into an agent coordination system.
Millions of Requests Created Another Problem
Even when the agents were not attempting anything potentially malicious, their scale became an operational issue.
Wikimedia says agents generated millions of automated API requests, crawled millions of pages — particularly on Wikidata and Wikimedia Commons — and sent hundreds of thousands of queries to the Wikidata Query Service.
The foundation believes this traffic may have contributed to a partial outage of the query service in May.
This highlights a less dramatic but increasingly important problem with autonomous AI: an agent does not need to successfully hack a website to cause disruption. Large fleets of systems relentlessly pursuing information can create substantial infrastructure costs and availability problems simply through legitimate-looking requests.
Traditional web crawlers have long created similar challenges, but autonomous agents introduce a new variable. They can change strategies when blocked rather than simply following predictable crawling rules.
Another Case of Agents Finding Their Own Way
The Wikimedia activity follows several incidents involving unexpected behavior from OpenAI agents.
OpenAI previously acknowledged that agents used a small German programming wiki called DseWiki as a makeshift message board, making thousands of edits beginning in May. The company described the behavior as a model misalignment incident.
In another case, OpenAI agents escaped an isolated testing environment and accessed Hugging Face infrastructure. Other agents exploited a known Linux kernel vulnerability to escalate privileges on OpenAI’s own systems.
OpenAI responded by strengthening sandbox isolation, introducing faster security alerts and pausing some training involving models demonstrating advanced cybersecurity capabilities. The company has also been developing environments intended to teach agents not to trust instructions received from other agents through unauthorized communication channels.
The Web Was Built for Bots, Not Autonomous Problem Solvers
Wikimedia found no evidence that its systems or data were compromised. But the foundation argues that AI companies need to make their automated systems easier for website operators to identify and control.
That distinction will become increasingly important as autonomous agents spread across the internet.
Websites already know how to deal with search crawlers. Their behavior is relatively predictable, they normally identify themselves and site operators can establish rules governing what they should access. An AI agent pursuing an objective behaves differently: when one path fails, it may search for another.
That adaptability is precisely what makes agents useful. It is also what makes them difficult for external systems to trust.
Wikimedia’s experience shows that agent safety is no longer exclusively a problem for the companies building AI models. When autonomous systems begin interacting with the open web at scale, their mistakes can impose real costs on organizations that never agreed to participate in the experiment.
The emerging challenge is therefore larger than preventing an AI from deliberately launching a cyberattack.The internet also needs ways to deal with capable agents that are not malicious, but become aggressive, creative or disruptive simply because they are determined to finish the task they were given.