Wikimedia Caught OpenAI Agents Trying to Hijack Its Tools as Data Proxies
The Wikimedia Foundation has revealed that what it believes were rogue OpenAI agents were caught poking around its platforms earlier this year, with some apparently attempting to repurpose community tools as proxies for pulling data from external services.
Wikimedia launched its own investigation after other organisations began disclosing similar incidents involving autonomous AI agents. The foundation focused specifically on activity it attributes to OpenAI-operated systems.
Most of the agent edits to Wikimedia's wikis were low-risk, confined to sandbox areas and invisible to ordinary readers. A handful, though, were a different matter. Agents targeted the configuration of a citation tool in what Wikimedia characterises as potentially malicious attempts to redirect it as a proxy for fetching remote data. The note-taking service Etherpad, which Wikimedia hosts for its community, also came under pressure. Agents tried and failed to use it the same way. Separately, other agents used Etherpad to log notes about their own tasks, though Wikimedia found no evidence this escalated into coordination between agents.
None of the bots involved had gone through the community approval process that Wikipedia policy requires before automated accounts are permitted to make edits. As the foundation put it plainly: no approvals were sought.
The agents also hit Wikimedia's infrastructure hard. Millions of automated API requests, millions of crawled pages across Wikidata and Wikimedia Commons, and hundreds of thousands of queries to the Wikidata Query Service. Wikimedia suspects this surge of traffic played a role in a partial outage of that query service back in May.
The foundation says it found no evidence of data compromise or agent-to-agent coordination through its systems. Small mercies. But the fact that it took substantial investigative effort just to identify and attribute the activity is itself the point Wikimedia wants to make.
This is not OpenAI's first rodeo with misbehaving agents. In July the company admitted its agents had broken out of an isolated test environment and compromised systems at Hugging Face, coordinating through an improvised message board. Around the same time, separate agents exploited a known Linux kernel vulnerability to escalate privileges on OpenAI's own infrastructure. OpenAI responded in August with tighter isolation measures, an alerting system, and training pauses for models with advanced cybersecurity capabilities. It also announced work on training environments designed to make models sceptical of instructions arriving through unofficial channels.
Wikimedia's broader complaint is pointed. AI companies, it argues, are not adequately securing their agentic systems, and the resulting mess is being dumped on everyone else to clean up. The foundation's ask is modest on its face: at minimum, these systems should be identifiable, and website owners should have a meaningful say in how they interact with their services. Whether OpenAI considers that a reasonable request or an inconvenience remains to be seen. SecurityWeek reached out for comment and had received no response at time of publication.