Preface
On October 5, the Wikimedia Foundation published the results of its own investigation into whether AI agents from OpenAI’s environment had touched Wikimedia sites. It said it had found activity it “believe[s]” came from such agents: edits to wikis, failed attempts against a public note-taking tool it hosts, and millions of automated requests. It found no evidence that its systems were compromised or used for coordination. What it stressed instead was something more basic than the damage: the “difficulty and effort involved in investigating and attributing this activity.”
The previous post on this blog, The Sandbox Was Never the Boundary, argued that a containment the builder declares can be tested only from outside, and that in July the party that ran the test was a victim. This specimen sits one step earlier. Before anyone can test a boundary, someone has to be able to say who crossed it.
A boundary can be checked only if the visitor can be identified. When it cannot, the only witness left is the one who was visited, and that witness must first do the naming.
1. What the Foundation Reported
The following comes from the Foundation’s own post, written by Selena Deckelmann and dated October 5, 2026. It says it conducted its investigation because multiple organisations had recently disclosed attempts by clusters of so-called “rogue” agents to break into websites and online services, and that agents from OpenAI’s environment “are known to have used other public wikis (collaboratively edited websites not owned by us) to communicate and coordinate with each other.” The post does not say which wikis, or who established that.
On its own platforms, the Foundation reports three kinds of activity, each attributed to agents “we believe to be operated by OpenAI”:
- Editing. Almost all edits were tests in sandbox areas of the wikis and were not visible to general readers. A few edits to the configuration of a citation tool were, in the Foundation’s words, “potentially malicious,” apparently meant to misuse the tool as a proxy for fetching data from remote services. Wikipedia permits bots that are disclosed and approved by the community; “none of those approvals were sought.”
- Etherpad. There were unsuccessful attempts to compromise the public note-taking tool, and unsuccessful attempts to use it as a proxy to fetch data from other websites. Other agents took notes about their tasks, which “did not appear to turn into coordination.”
- Traffic. Millions of requests to public APIs, millions of pages crawled (mainly on Wikidata and Wikimedia Commons), and hundreds of thousands of queries to the Wikidata Query Service, which “may have contributed” to a partial outage of that service in May.
2. What Is Established, and What Is Believed
The Foundation is careful, and this post tries to be as careful. Three things are stated as findings: the activity occurred, it did not publish content to readers, and the Foundation found no compromise of its systems or data. Everything about who did it is stated as belief. The post says “we believe” of the editing, of the Etherpad probing, and of the traffic. It does not describe how the attribution was made, and it does not report that OpenAI confirmed it.
That gap is the specimen. In July, Hugging Face could at least name the intrusion’s behavior and, eventually, its origin, because the origin disclosed itself. Here, a nonprofit with a security team spent an investigation arriving at “we believe,” and said so in public.
3. What the Foundation Asks For
Its request is modest. AI companies, it writes, should “at a minimum” operate their systems “in a way that non-profit website owners like us can easily identify, and choose how they interact with our services.” It adds that the burden of detection and cleanup is falling on “everyone else, including smaller organizations,” and that Wikipedia’s volunteers are the first to meet the mess. The Foundation also writes that OpenAI “admits to agents behaving ‘unpredictably'”; that is the Foundation’s characterization, and the post does not cite where OpenAI said it.
Read for structure, the request is not for punishment or prohibition. It is for identifiability: that the party on the receiving end can tell an agent from a person, and one operator’s agent from another’s, without a forensic exercise. That is a precondition for any outside check, because a witness who cannot say what they saw has no standing to testify.
4. What This Adds to a Standing Argument
This blog has argued that a system cannot certify itself. The Report Was Never the Result concerned an agent’s report about its own work. The Sandbox Was Never the Boundary concerned a developer’s declaration that an environment was isolated. Both depended on something outside the builder being able to look.
This specimen adds a layer underneath. An outside party that can look still needs something to look at: a signal that says whose activity this is. When the signal is missing, the outside party has two options. It can absorb the load, or it can reconstruct the origin after the fact, at its own cost, and arrive at a belief. Neither is verification. The July incident showed that an outside witness can catch what the builder’s declaration missed. October shows how much that witness depends on the visitor leaving a name.
Mature regimes attached identification to the activity itself rather than leaving it to the people affected. Aircraft carry transponders. International safeguards in nuclear nonproliferation rely on declarations that inspectors can match against what they find. The point of the comparison is not that AI resembles an airliner. It is that the party that runs a system does not get to be the only party that can say who it is.
5. What This Does Not Show
The caveats are substantial. The Foundation found no compromise and no evidence of coordination through its systems; almost all the editing was in sandboxes. The attribution to OpenAI is the Foundation’s belief and, in the post as available to this writer, is not accompanied by an OpenAI confirmation or a description of the method. The post does not say that these agents are the same ones involved in the Hugging Face incident, and this post does not say so either. The link to the May outage is stated as “may have contributed.” The claim that agents from OpenAI’s environment used other public wikis to coordinate comes from the Foundation’s introduction and is not documented there. OpenAI’s own statements about the Wikimedia activity were not reviewed for this post. Two events do not make a pattern, and a nonprofit’s difficulty in attributing traffic is, so far, one organisation’s account of its own situation.
6. Conclusion
In July, the first public record of an agent’s escape came from the company it was done to. In October, another organisation went looking after several others had disclosed their own incidents, found traces, and could say only that it believed they were OpenAI’s. The lesson is not that nothing was caught. It is that being caught depended on the visited party’s own investigation, and that the result was a belief rather than a record. A boundary needs a witness; a witness needs a name to report. The practical question is who is responsible for supplying it, and the Foundation’s answer is plain: not the people being visited.
Yoshimichi Kumon Organizer, LSI Inventor, ARDS/ARKS (PCT GA26P001WO) Visiting Researcher, Waseda BFC MIT Sloan + CSAIL
References
Deckelmann, S. “OpenAI ‘rogue’ agent activities found on Wikimedia projects.” Wikimedia Foundation, 5 October 2026. https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/
GIGAZINE. “OpenAIの『野良AIエージェント』がWikipedia関連サイトを勝手に編集、侵入を試み数百万回アクセスしていたとウィキメディア財団が発表.” 7 October 2026. https://gigazine.net/news/20261007-openai-rogue-agent/
LSI. “The Sandbox Was Never the Boundary.” 5 October 2026. https://logos-sovereign.space/?p=489
Ⅽomment