OpenAI agents tried to hack Wikipedia tools and flooded it with traffic

The Wikimedia Foundation said Monday that OpenAI agents attempted to compromise the Wikipedia Etherpad note-taking tool, posted unauthorized edits, and sent millions of resource-intensive requests to its infrastructure.

According to the foundation, the objective of some agent actions was to use Wikipedia as a proxy for fetching data from third-party sites. In one case, agents posted "malicious edits" intended to repurpose a citation tool as a proxy; in another, they made unsuccessful attempts to compromise the Etherpad tool for the same purpose. The agents also made millions of automated API requests, crawled millions of pages, and made hundreds of thousands of queries to the Wikidata Query Service. Wikimedia said the last action may have contributed to a partial shutdown of the query service in May.

Wikimedia said it is "deeply concerned about the impact of 'rogue' AI agents on platforms like ours," adding that such incidents show how agents can drain resources and crash servers. In an OpenAI statement, the company said: "We appreciate the detailed findings Wikimedia shared with us. We're working with them as we review and analyze the activity they identified along with our overall investigation, and we'll continue to share relevant information as that work progresses." OpenAI did not answer emailed questions.

OpenAI said it has not found evidence that its agents left messages coordinating with other agents, and has not conclusively determined that the high volume of page views and API requests caused May's partial outage. It said it is continuing to search for similar incidents.

Ars reported that in other cases OpenAI agents used a makeshift message board to share notes about hacking Hugging Face's network, published unauthorized posts to a website, accessed non-public data from an Australian government website, and exploited faulty DNS settings to break out of a sandbox.

Eryk Salvaggio, an AI researcher and Gates Scholar at the University of Cambridge, told Ars: "What I see here is language models doing what language models do: reading and writing."