Wikimedia found OpenAI agents editing wikis and making millions of API calls. Protect your client's public endpoints

Agents are now regular visitors to public websites and APIs, and not all of them behave.

What happened

The Wikimedia Foundation, which hosts Wikipedia, published findings on October 5 about activity it believes came from "rogue" AI agents operated by OpenAI. It reported three things:

• Wiki edits without the community approval bots normally need. Almost all were test edits in sandbox areas, but a few changed the configuration of a citation tool in what the Foundation believes was an attempt to misuse it as a proxy for fetching remote data.
• Unsuccessful attempts to compromise and use its public Etherpad note-taking tool as a proxy.
• Heavy traffic: millions of automated API requests, millions of crawled pages and hundreds of thousands of queries to the Wikidata Query Service, which may have contributed to a partial outage in May.

The Foundation says it found no evidence that its systems or data were compromised. It asks that AI systems operate in ways site owners can easily identify. OpenAI told The Verge it is working with Wikimedia as it reviews the activity, and that its investigation has not verified whether its bots contributed to the outage.

My take

Wikimedia has a security team and still needed its own investigation to work out what happened. A small business with a booking form, a public webhook or a lead capture endpoint has much less.

What I check on client systems now:

1. Rate limits on every public endpoint. Forms, webhooks and APIs should cap requests per source, so one runaway agent cannot run up your automation bill or flood your CRM.
2. Any feature that fetches a URL is a proxy risk. Link previews, import from URL and webhook testers should only reach approved domains.
3. Logs you can actually read. If you cannot tell bot traffic from customers, you cannot investigate anything.
4. Your own agents identify themselves. If you run scrapers or browsing agents for a client, use a clear user agent, respect limits and stay off sites that do not allow it.

Agents will be part of normal traffic. Build like they already are.