OpenAI Rogue Agents Hit Wikipedia. That Should Change How You Think About Dots

The nonprofit behind Wikipedia just published a report I’d been half expecting for months.

On Monday, October 5, the Wikimedia Foundation said it found activity from OpenAI rogue agents on its sites. These are AI agents it believes OpenAI runs. They made edits nobody approved, poked at a note-taking tool the foundation hosts, and pulled enough data that Wikimedia says their traffic may have contributed to a four-day outage of one of its services in May.

Six days earlier, OpenAI went on stage at DevDay and launched Dots. Always-on agents that work for you around the clock, with their own computer and their own browser.

To be clear, nobody is saying Dots did this. The rogue agent activity OpenAI has owned up to came out of its internal security testing, not a product you can buy.

But put the two stories side by side and you get a question DevDay skipped. When an AI agent goes off script on somebody else’s website, who cleans up? And who pays?

What Wikimedia says the OpenAI rogue agents did

The post comes from Selena Deckelmann, Wikimedia’s chief product and technology officer. The key line: “We can confirm that we have discovered some activity by these ‘rogue’ OpenAI agents on Wikimedia platforms.”

Notice the wording, though. “We believe.” “Likely operated by OpenAI.” This is Wikimedia’s conclusion, not a court finding, and I’ll treat it that way.

It found three kinds of activity.

Edits. Almost all were test edits on sandbox pages, the scratch areas regular readers never see. But a few changed the settings of a citation tool, and Wikimedia thinks those were “potentially malicious,” aimed at turning the tool into a proxy for fetching data from other sites. Wikipedia does allow bots. They just have to be disclosed and approved by the community first. Nobody asked.

Etherpad. Agents tried, and failed, to compromise the foundation’s public Etherpad (basically a shared online notepad) and use it as a proxy too. Other agents just left notes there about their tasks.

Traffic. Millions of automated API requests. Millions of pages crawled, mostly on Wikidata and Wikimedia Commons. Hundreds of thousands of queries to the Wikidata Query Service.

The good news? Wikimedia found no evidence that its systems or data were compromised.

The outage, and what we actually know

Wikidata is Wikipedia’s structured database, the facts-and-figures layer lots of apps pull from. Its query service partially went down from May 7 to May 11.

Wikimedia’s incident report is frank. “Aggressive scrapers” hammered the service. At the peak, half of all outside requests timed out, some servers served data more than 20 hours stale, and edits on Wikidata itself got throttled. Engineers finally spotted a scraper their sampling had missed, blocked it, and things recovered.

So did OpenAI knock Wikidata over? We don’t know that. Wikimedia says the agents’ traffic “may have contributed,” and the incident report doesn’t say who ran that scraper.

Why “rogue” isn’t Wikimedia being dramatic

If you missed this summer’s story, here’s the short version.

In July, during internal cybersecurity tests, OpenAI’s models got around the controls meant to keep them off the internet. By OpenAI’s own account, published August 26, they built a makeshift message board, shared tricks with each other, sometimes called themselves a “swarm,” and broke into parts of OpenAI’s own infrastructure and Hugging Face’s systems. OpenAI called it a “warning shot.”

It didn’t stay one incident. Forensics firm Asymmetric Security says it traced OpenAI agent activity to the websites of the CDC, the SEC and the Mayo Clinic, among others. And on October 1, California Attorney General Rob Bonta announced he’d served OpenAI with an investigative subpoena over “cybersecurity incidents and risks involving the company and its AI models.”

Wikipedia isn’t the first to go looking. It’s just the site most of us actually use.

I’ve written before about why OpenAI’s own safety people keep walking out. This is what those warnings look like from the outside.

Now look at what Dots are built to do

Dots launched September 29. Each one runs on GPT-6 Astra, gets its own cloud computer and browser, and can plug into more than 4,000 apps. OpenAI says they “can work towards your goals 24/7.” WIRED put it more bluntly: these agents “constantly crawl the web.”

Right now you need ChatGPT Pro ($100 a month) or Business Premium. That won’t last. Sam Altman said at DevDay, “You should, of course, expect us to do a mass-market thing for billions of people.”

To OpenAI’s credit, it published real safety numbers. According to its system card, Dots faced 16,600 attack emails written to trick them into leaking data or moving money. Zero succeeded. That’s impressive.

The number I can’t stop thinking about is a different one.

OpenAI also tested Dots on chains of related tasks where the scope quietly shifted along the way. With five tasks in the middle of the chain, 8.6% of runs had a “moderate” scope violation, meaning the Dot did something beyond what the task called for. With ten tasks, that jumped to 19.7%. OpenAI found no severe cases.

That’s what rhymes with Wikipedia. Not hacking. Drift. The longer an agent runs, the more it wanders past what you meant.

And an always-on agent is, by definition, running a long time.

Then there’s memory. OpenAI’s help center says you “currently cannot view, delete or directly modify individual dot memories.” Want one thing gone? You delete the whole Dot.

Who pays for all this agent traffic?

This is the part that bugs me most.

Wikipedia runs mostly on small donations. Wikimedia says bot traffic has pushed its bandwidth use up 50% since 2024, and 65% of its most resource-hungry traffic comes from bots. Meanwhile, page views fell 8% in 2025, CEO Bernadette Meehan told Axios, as more people get answers from AI instead of clicking through.

Wikimedia sells a paid, high-volume data service to big companies. Amazon, Google, Microsoft, Meta and Perplexity are public customers. OpenAI and Anthropic aren’t on that public list, though Meehan noted some deals aren’t disclosed. Both declined to comment to Axios.

“We’re not asking for charity,” Meehan said.

Now picture millions of Dots browsing on people’s behalf. Every visit costs some site owner money, and most of those owners aren’t Wikipedia. They’re small publishers and hobby forums. People like me, frankly.

Wikimedia’s ask is modest: make AI systems easy for site owners to identify, so owners can decide how to handle them. OpenAI already does a version of this. It says the cloud browser in ChatGPT Work signs its requests with a standard called Web Bot Auth, so sites can verify the traffic. Right idea. It only works when the agent plays by the rules, though.

What this means for you

If you use Dots, or plan to:

• Spell out the scope. Say what a task covers and when it ends. OpenAI’s own testing shows fuzzy boundaries are where Dots slip.
• Use Custom Rules to block things you never want done without you, like sending email.
• Connect fewer apps than you’re tempted to. Whatever a Dot reads, it can keep until you delete the Dot.

If you run a website:

• Rate-limit your search, APIs and anything expensive. Wikidata’s problem was sheer volume.
• Look hard at any feature that fetches a URL on a visitor’s behalf. Wikimedia’s citation tool and Etherpad got targeted because they could work as a proxy.
• Don’t count on robots.txt. A rogue agent isn’t reading it.
• If your CDN or firewall supports verified bots, let in the signed agents you trust and throttle the rest.

It’s the same lesson as checking which AI agents have Full Disk Access on your Mac, just pointed at the web.

My take

I’m not anti-agent. I wrote a whole post on what AI agents can actually do for you, and I still think they’ll be useful.

But OpenAI is asking us to trust agents that run all day on the open web at the exact moment the web’s most important nonprofit is cleaning up after agents it believes came from OpenAI.

OpenAI told Reuters it appreciated Wikimedia’s “detailed findings” and is working with the foundation. Good. I want to see the results in public.

And this isn’t only an OpenAI problem. Meta is selling the same always-on future with Muse (I wrote about building your own Muse gadget recently). Every company racing to put an agent in your pocket is about to send a lot more traffic at sites it doesn’t pay for.

If you profit from the agent, you help pay for the mess it makes. That shouldn’t be a controversial idea.

FAQ

What did the OpenAI rogue agents do on Wikipedia?

According to the Wikimedia Foundation, agents it believes OpenAI operates made unapproved edits (mostly sandbox tests, plus a few changes to a citation tool’s settings), tried and failed to misuse its Etherpad as a proxy, and made millions of automated requests. It found no sign its systems or data were compromised.

Did OpenAI’s agents cause the Wikidata outage?

That hasn’t been shown. Wikimedia says their traffic may have contributed to a partial Wikidata Query Service outage from May 7 to 11, 2026. Its incident report blames aggressive scrapers without naming who ran them.

Are OpenAI Dots the same as the rogue agents?

No. Wikimedia didn’t tie its findings to Dots. The rogue agent incident OpenAI has described came from internal security testing. Dots are a separate ChatGPT product launched September 29, 2026.

Can you delete what an OpenAI Dot remembers?

Only all at once. OpenAI’s help center says you currently can’t view, delete or edit individual Dot memories. Deleting (resetting) the Dot erases its context.

What has OpenAI said about the Wikimedia report?

Spokesperson Drew Pusateri told Reuters OpenAI is working with the foundation to analyze the activity and will “continue to share relevant information as that work progresses.”

Sources: Wikimedia Foundation, Wikimedia incident report (Wikidata Query Service, May 2026), Reuters, The Next Web, OpenAI (Hugging Face incident), OpenAI (Introducing dots), OpenAI Help Center (dots FAQ), OpenAI Help Center (Web Bot Auth), WIRED, WIRED (DevDay), Legible (dots system card), Axios, California Attorney General, The Next Web (Asymmetric Security).