Autonomous AI agents constantly collect information from the internet, but this time they did more than just read Wikipedia articles.
According to reporting on a Wikimedia Foundation investigation, OpenAI agents made unauthorized wiki edits and attempted to misuse a public note-taking tool as a proxy. This incident turns a common debate around AI scraping into a security question: Who is responsible when an agent’s pursuit of a task imposes an operational cost on someone else’s infrastructure?
The scale of this recent example makes the question hard to ignore. BleepingComputer reported that the agents made millions of API requests and crawled millions of pages associated with Wikidata and Wikimedia Commons. The agents also submitted hundreds of thousands of queries to the Wikidata Query Service.
Wikimedia said traffic may have contributed to a partial service outage in May. The organization found no evidence that its systems or data were compromised, and the suspected edits were generally made in sandbox areas rather than pages visible to ordinary readers.
Would your team catch the next zero-day in time?
Join security leaders who rely on the Think Newsletter for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox twice weekly. See the IBM Privacy Statement.
This distinction between a disruption and a full-blown breach is important to note. This instance was not reported as a successful compromise of Wikipedia’s public content. Instead, experts say it should serve as a warning about what can happen when persistent software, broad network access and open public services converge without adequate containment.
On the Security Intelligence podcast, Seth Glasgow, Cyber Range Executive Advisor at IBM, rejected the idea that unpredictable agent behavior absolves its operator. “The agent didn’t decide to do this to Wikipedia because it was fun. It doesn’t have that notion,” he said. “It was given an incentive structure by OpenAI to do it.” Glasgow compared the issue to controlling an unleashed dog or a backyard fire: responsibility remains with the person who introduced the risk.
This is not an isolated issue involving AI agents going rogue. In fact, the accountability question is becoming larger with each new advancement in AI technology.
Dark Reading reported on October 16 that agent escapes involving systems from several AI developers have renewed questions about liability when autonomous systems access external organizations. It’s reporting concluded that human responsibility might be clear, in principle, even though the law has not caught up yet.
The technical answer is not simply to make agents less determined. Ian Molloy, Department Head of Security Research at IBM, argued that persistence is part of what makes agents useful. The failure comes when that persistence operates without effective confinement and monitoring. “Where’s the leash that you actually put on the agents? Where are the guardrails?” Molloy said. “How are you confining and how are you monitoring them so that you know exactly what the agent is doing?”
Molloy also argued that a sandbox with broad network access is not meaningful isolation. He proposed giving agents designated, observable services through which they can communicate. This reduces the incentive to repurpose public platforms while giving operators a clearer signal to monitor.
Some suggest the outright blocking of agents from platforms, but this solution poses its own problems. Wikimedia exists to distribute knowledge, Molloy said, and aggressive controls could also burden readers, researchers, search engines, accessibility tools and the volunteer-built software surrounding its projects.
One suggestion, using the robots.txt file, which website owners implement to give instructions to web robots about their site, may fall short for this task. Dark Reading separately reported that robots.txt restrictions express a site owner’s preference but “lack the technical means to impose it.” This is a clear illustration of the gap between web policy and machine behavior.
The Wikimedia incident exposes a design problem for the age of the agentic internet. Open services can rate-limit or block suspicious traffic, but those are only downstream defenses. The stronger control point lies with the organizations deploying autonomous systems. Cybersecurity experts recommend these teams restrict network access, maintain observable agent identities, constrain available tools and stop all activity that escapes its intended environment.
Without applying these controls, public-interest platforms will be pushed toward more restrictive defenses. The cost will not fall only on AI developers, but more importantly, it will fall on the people and institutions the open web was built to serve.
