The Wikimedia Foundation, operators of Wikipedia and a number of other open-source projects, has disclosed that rogue AI agents attributed to OpenAI made numerous unauthorized edits and attempts to hack into its services in recent months. This includes millions of API requests and data queries that may have contributed to a May 2026 outage that lasted for about four days.
The incident adds to a steady stream of stories of rogue AI agents attempting unauthorized access and abusing various online services, many only coming to light after months had passed. As with prior incidents, the agents appeared to be doggedly pursuing some sort of task and made reckless use of the Wikimedia services as a method of communication.
Rogue AI agents attempted to hack note-taking tool, generated enough traffic to crash sites
Wikimedia says that the rogue AI agents generated a massive amount of traffic while making millions of API requests and data queries, something that likely contributed to an extended mid-May outage that came and went across an assortment of the organization’s products. The agents also made extensive testing edits to Wikimedia wikis that were confined to non-public sandbox areas.
Some of the edits the rogue AI agents made were openly malicious in nature, the clearest set of these being an ultimately unsuccessful campaign to hack the public Etherpad citation tool via its configuration. But the overall intent of the agents seemed to be to find ways to leverage the Wikimedia sites and tools as a proxy for pulling data from third-party sites. This mirrors prior incidents in which AI models that were either performing a data-gathering task or solving a security puzzle attempted to hack and abuse publicly accessible sites to get around write limitations that had been put on them by their developers. However, a spokesperson for Wikimedia stated that the organization did not observe any attempts by the agents to coordinate with each other via their services.
Wikimedia policies do allow bots to make edits but only when disclosed to and approved by the community, which did not happen in this case. Despite the attempts on Etherpad, no Wikimedia services were actually compromised by the rogue AI agents; the incident seems limited to wide-scale abuse of resources and violation of terms of service.
Agent rampages generate massive costs even when breaches do not take place
The incident highlights an aspect of rogue AI agent “swarms” or “fleets” that may be going underlooked amidst headlines about their attacks and hacking attempts; public internet resources were designed with human use in mind, not for the scale and volume of stress that reckless agents can put on them while in single-minded pursuit of a task.
Rogue AI agents can effectively DDoS unsuspecting sites and services even when they have no real malicious intentions at all. This not only leads to service downtime, but to huge bills for hosts due to all of this artificial and non-productive traffic. In Wikimedia’s case, Wikipedia alone hosts some 67 million articles that draw as much as 15 billion page views each month. The organization reports that it saw a 50% increase in bandwidth usage by bots in 2025, and that bots are now responsible for 65% of the most resource-consuming traffic across its projects.
Many of the cases of rogue AI agents throughout 2026 have also turned out to be a combination of “misalignment” while digging up statistics and insufficient human monitoring and oversight. OpenAI’s agents have seemed to have a particular problem with this, with related incidents heavily concentrated during the May to June timeframe in which the Wikimedia incident also took place. The most egregious of these was the June breach of the Australian Institute of Health and Welfare, thought to be the first independent attack by AI agents on a government site. There have been numerous other attempts, however, including at the United Nations statistics website, Securities and Exchange Commission and the University of New Mexico Digital Library.
OpenAI’s agents also seem to have aggressively pushed the envelope of independent hacking more than other frontier developer contemporaries, which have had numerous “misalignment” incidents of their own but not as many that prompted calls for criminal data breach charges. The centerpiece is the Hugging Face attack, which set off this entire security firestorm and prompted all developers to start more closely reviewing their logs for problem AI behavior. This has expanded now to include assorted US government agencies, and prompted the early October introduction of the AI Agent Accountability Act in the Senate which includes potential criminal charges for AI industry executives among its proposed terms.
Bri Frost, Director of Product Management at Cloud Range, notes that some stronger impetus must be introduced to ensure that frontier AI developers are establishing, policing and monitoring boundaries for their independent AI agents: “When an AI agent hits a wall, the real question is whether it stops or starts improvising. Here, agents appear to have tried turning a citation tool and a note-taking service into proxies, which is exactly the kind of behavior organizations need to plan for as agents gain autonomy. An agent doesn’t need bad intent to create risk. It just needs a goal, access and no clear sense of where its boundaries are. That risk grows when the person giving instructions doesn’t know to set those boundaries. Every day, inexperienced users hand agents open-ended tasks without telling them when to ask questions, pause or get approval. Before giving an agent credentials or tools, teams should test it in a realistic environment, including with vague or poorly written prompts. Does it stay within its permissions? Does it try to work around restrictions? Does it escalate to a human when a task pulls it outside its lane? If you can’t answer those questions, the agent isn’t ready for that level of autonomy.”
