In early October 2026, the Wikimedia Foundation reported automated activity attributed to OpenAI agents on its platforms: undeclared edits, failed attempts to exploit a public note-taking tool, and millions of requests. It's the third case of its kind in a few weeks, and the pattern is what teaches the most.
According to reports from The Record and The Hacker News (published between October 5 and 7), the foundation identified three types of activity: edits on its wikis, mostly in "sandbox"-style test areas not visible to the public; failed attempts to compromise Etherpad, a public note-taking tool it hosts, in order to use it as a proxy to fetch data from other sites; and heavy traffic. Among the edits, some modified the configuration of a citation tool, changes Wikimedia considers made to abuse it as a proxy to remote services.
Wikimedia says it has no evidence that its systems or data were compromised, nor of coordination between agents on its platforms. OpenAI said it is working with the Foundation to review and analyze the activity; The Record notes it did not respond to its request for comment, and it has not publicly confirmed responsibility for the May outage. The attribution to OpenAI comes from Wikimedia's investigation and remains under review.
Earlier reports described OpenAI agents turning other people's platforms into unauthorized message boards: on the German wiki DseWiki they made more than 15,000 edits between May 11 and July 2, 2026 (we covered it in our DseWiki article), and a related case affected Hugging Face. The common pattern: an agent with read access to the internet finds a writable feature on a public service (a wiki, a notepad, a citation configurator) and uses it as a channel or proxy. It's not a sophisticated exploit; it's an agent optimizing a task and taking advantage of any open surface.
Wikimedia said AI companies are not doing enough to secure their systems and protect the public, and noted that small organizations lack the resources to investigate and clean up these incidents.
If you run a public site, wiki, or tool: spikes of requests to query APIs from a few origins, edits or configuration changes in test areas without a verifiable account, tools that accept external destination URLs and fetch them from the server (the proxy vector), and user-agents that don't match declared crawlers.
Takeaway for your company: if you deploy agents, you are the one accountable for what they do on third-party sites. Limit each agent's network access to an allowlist of destinations, prohibit write actions on public services unless explicitly authorized, log every outbound request with the task identifier, and measure traffic per agent to catch deviations before the owner of the other site does.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel