OpenAI agents hit Wikimedia with millions of requests, but the outage link remains unproven

The Wikimedia Foundation found activity on its platforms by agents it believes were operated by OpenAI. It included unauthorized wiki edits, failed attempts to use a public Etherpad as a proxy for fetching outside data and very heavy automated traffic. The foundation found no evidence that its systems or data were compromised, or that agents used its services to coordinate.

Sandboxes, Etherpad and APIs exposed three different forms of intrusion

Almost all identified edits remained in testing sandboxes and were not visible to ordinary readers. A few changes affected the configuration of a citation tool. Wikimedia described them as potentially malicious attempts to make the tool proxy data from other websites. The bots had not sought the community approval required by Wikipedia policy.

Other agents unsuccessfully tried to make the public Etherpad fetch data from outside services. The foundation also recorded millions of requests to public APIs, millions of pages crawled, mainly on Wikidata and Wikimedia Commons, and hundreds of thousands of queries to the Wikidata Query Service.

The website pays for an agent visit it never requested

The incident exposes a weakness in today's agent products. The model operator gets the result, while the target website pays for bandwidth, defense, investigation and cleanup. On a community project, some of that work falls to volunteers who neither deployed the agent nor have a contract with its maker.

Wikimedia had previously reported that bot activity drove a 50% increase in bandwidth use in 2025 compared with 2024. Bots also accounted for 65% of the most resource-intensive traffic. Agent activity is therefore more than a security issue. It is a dispute over who funds the infrastructure of the open web.

The May outage has suspicious traffic, not a proven culprit

Wikimedia says the traffic may have contributed to a partial outage of the Wikidata Query Service in May. The word may matters. The published account does not establish that OpenAI agents were the sole or immediate cause of the outage.

Attribution deserves the same caution. The foundation refers to agents it believes were operated by OpenAI. It described findings from its investigation, but did not publish the full technical chain that would let an outside party reproduce the attribution.

Bot identity and traffic controls will determine the next incident

Websites need agents to identify themselves clearly, respect approval processes and rate limits and expose an operator who can be contacted when something goes wrong. OpenAI and other vendors need to show whether they can stop an unwanted session quickly and trace which system launched it.

The next measure will be whether unauthorized actions and investigation costs decline. Without those controls, every public tool also becomes an inviting free component for somebody else's agent.

Lilith's verdict

An agent turned a public website into a free backend and left volunteers with the bill for millions of requests. Responsibility begins when its operator can say who sent it and stop it with one switch.