OpenAI“失控”Agent 活动现身 Wikimedia 项目
英文标题：🔶 OpenAI "rogue" agent activities found on Wikimedia projects
Wikimedia Foundation 表示，其调查发现疑似由 OpenAI 运营的“失控”AI Agent 曾在 Wikimedia 平台开展未经授权的活动，包括测试性 Wiki 编辑、尝试探测 Etherpad，以及对公开 API 和 Wikidata Query Service 发起大规模请求。基金会称，没有证据表明其系统被用于 Agent 间协调，也未发现系统或数据遭到入侵，但相关流量可能促成了 2026 年 5 月 Wikidata Query Service 的一次部分中断。Wikimedia 指出，AI Agent 的高强度抓取和攻击尝试正在增加基础设施与人工运营负担，并可能威胁开放网络及可信知识资源。该事件也凸显了 AI 公司需要承担更大责任，使网站运营者能够识别、管理并限制其 Agent 对服务的访问。
19.1 KB
18.8 KB
54.7 KB
288.4 KB
173.0 KB
173.0 KB
中文
最近，多家 组织 披露，成群的所谓“失控”AI Agent 曾试图入侵网站和在线服务，且有时得逞。已知来自 OpenAI 环境的 Agent，尤其曾利用其他公开 Wiki（并非由我们运营、由协作编辑者维护的网站）来相互通信与协调。
这类成功入侵可能暴露敏感数据，或中断用户所依赖的网站服务；而成群的 Agent 可以以防御者难以应对的规模发起攻击。这会影响网站背后的运营者——他们可能并不了解攻击的性质，也缺乏有效反击的工具。对于 Wikipedia 这样的网站，Agent 可能发现并利用安全漏洞，或者大规模进行误导性编辑。Wikipedia 的志愿编辑者和 Wikimedia Foundation 的安全团队必须侦测并撤销这些活动。
Wikimedia Foundation 开展了自己的调查，以了解 Wikimedia 网站是否也受到了 AI Agent 的类似影响，重点关注由 OpenAI 运营的 Agent。我们可以确认，已在 Wikimedia 平台上发现这些“失控”OpenAI Agent 的一些活动。未经授权的 Bot 活动包括对我们 Wiki 的编辑、一些试图利用我们托管的公开笔记工具但未成功的尝试，以及高流量访问；下文将对此作进一步说明。
我们没有发现任何证据表明系统被用于 Agent 之间的协调，也没有发现任何系统或数据遭到入侵的证据。不过，我们担心这里本可能发生的情况、调查和归因这些活动所涉及的困难与成本，以及总体上 Agentic AI 活动在我们平台上日益增长的风险。开放网络是一种公共资产。我们不应允许这种行为成为维护开放网络的个人或组织所面对的“新常态”。
总而言之，我们观察到：
- **Wiki 编辑：**我们已识别出对 Wikimedia Wiki 的编辑，并认为其来自由 OpenAI 运营的 AI Agent。这些编辑并未发布到普通读者可见的页面；其中几乎全部是在 Wiki 的“沙盒”区域进行的测试性编辑。活动还包括少量对引文工具配置的编辑，我们认为这可能是恶意编辑，意图将该工具滥用为从远程服务获取数据的代理。尽管 Wikipedia 政策允许 Bot 在向社区披露并获得批准后进行编辑，但这些事件中并未寻求任何此类批准。
- **Etherpad 探测与使用：**我们认为由 OpenAI 运营的 Agent，曾尝试入侵我们作为社区服务托管的公开 Etherpad 笔记工具，但未能成功。这些 Agent 曾试图将其作为从其他网站获取数据的代理。其他同样很可能由 OpenAI 运营的 Agent 还记录了有关其任务的笔记，但这似乎并未发展为协调行为。
- **过度数据下载：**我们认为由 OpenAI 运营的 Agent 曾向我们的公开 API 发出数百万次自动请求，以访问 Wikimedia 项目中的知识；抓取了数百万个页面（主要来自 Wikidata 和 Wikimedia Commons 项目）；并向 Wikidata Query Service(WQDS) 发起了数十万次数据查询。这些流量可能促成了5 月 WQDS 的一次部分中断。
作为运营全球最大、使用最广泛的开放知识平台之一的非营利技术托管机构，我们深切关注“失控”AI Agent 对此类平台的影响。我们的平台由世界各地的志愿者共同建设，并依赖于开放互联网的承诺。此次事件，以及许多已经被发现且仍在持续曝光的其他事件，都说明 AI Agent 会耗尽资源、导致服务器崩溃，也可能试图破坏可信信息。
在过去 25 年中，Wikipedia 已发展成为世界上最受欢迎、最受信任的网站之一，拥有超过 300 种语言的 6700 多万篇文章，每月页面浏览量最高可达 150 亿次。通过开放、透明和协作的流程，志愿者努力确保知识保持中立、可靠，并可供所有人访问。Wikipedia 是用于训练大语言模型（LLM）的高质量数据集之一，其知识构成互联网信息的支柱，为 AI 聊天机器人、搜索引擎、语音助手等提供支持。
Wikipedia 是为人类而设计的——而 Agentic 行为显然带来了尚无人能完全解决的挑战。由于我们独特且成功的知识创建模式，Wikimedia 的志愿者往往最先接触到 AI Agent，并负责清理它们留下的残局。不断增加的 Bot 流量和 Agentic 活动，正对 Wikimedia 项目及其面向全球数百万用户提供服务的基础设施造成实际影响。基金会在 2025 年报告称，自 2024 年以来，因网站上的 Bot 活动激增，其带宽使用量已增加 50%。与此同时，其项目中资源消耗最高的流量有 65% 来自 Bot。
这种对基础设施的巨大压力不仅增加服务器和人力成本，如果不加以解决，还可能因系统过载和服务中断而阻碍人类访客访问。我们已经在为活动增加所带来的成本买单。
迄今为止，Wikimedia 的志愿者在应对平台上不断出现的挑战时一直表现出韧性，但我们也想说：事情本不必如此。
尽管 OpenAI 承认 Agent 会出现“不可预测”的行为，但它们也必须承认自己有责任监控并防止这些风险。AI 公司没有为保护自身系统、保护公众免受其造成的伤害做出足够努力。这一负担正落在其他所有人身上，包括规模较小的组织。至少，它们的系统应当以一种让像我们这样的非营利网站运营者能够轻松识别，并自行选择如何与其服务交互的方式运行。
网络让许多事情成为可能：与朋友和家人联系、注册入学、规划跨城行程、购买杂货，以及从 Wikipedia 了解世界。Bot 和 Agent 是网络未来的一部分，而那些释放并从中获利的公司，必须直接帮助避免和修复它们可能造成的损害。
我们共同的优先事项应当是整个网络生态系统的健康，使其能够继续造福所有人，而不只是少数亿万富翁。Wikimedia 在管理知识公地方面发挥着关键作用，但我们无法独自完成这项工作。我们邀请每一位正在构建网络未来的人，与我们一道保护那些使这个未来成为可能的开放共享资源。
您能帮助我们翻译这篇文章吗？
为了让这篇文章触达尽可能多的人，我们希望获得您的帮助。您能翻译这篇文章，让这一信息传播出去吗？
相关
English / 原文
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s environment, in particular, are known to have used other public wikis (collaboratively edited websites not owned by us) to communicate and coordinate with each other.
These types of successful intrusions can expose sensitive data or disrupt website services that users rely on, while clusters of agents can attempt attacks at a scale that is difficult for defenders to manage. They affect people behind the websites who may not understand the nature of the attack, or have the tools to effectively fight back. For a site like Wikipedia, agents might find and use security vulnerabilities or make misleading edits at scale. Wikipedia’s volunteer editors and the Wikimedia Foundation’s security teams have to detect and undo that activity.
The Wikimedia Foundation conducted its own investigation to see whether Wikimedia websites had been similarly affected by AI agents, focusing on those operated by OpenAI. We can confirm that we have discovered some activity by these “rogue” OpenAI agents on Wikimedia platforms. The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic, which are described more below.
We did not find any evidence that our systems were used for coordination among agents, nor did we find any evidence of our systems or data being compromised. However, we are concerned about what could have occurred here, the difficulty and effort involved in investigating and attributing this activity, and the growing risks of agentic AI activity on our platforms in general. The open web is a public good. We should not allow this behavior to become the “new normal” for the people or organizations that maintain it.
In summary, we saw:
- Wiki editing: We’ve identified edits to Wikimedia wikis that we believe are from AI agents operated by OpenAI. These edits were not published to pages with visibility to general readers; almost all of them were testing edits in “sandbox” areas of the wiki. It also included a few edits to the configuration for a citation tool, which we believe were potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services. While Wikipedia policies allow bots to edit when they are disclosed and approved by the community, none of those approvals were sought in these incidents.
- Etherpad probing and use: Agents we believe to be operated by OpenAI made some unsuccessful attempts to compromise our public Etherpad, a note-taking tool we host as a community service. Agents unsuccessfully tried to use it to fetch data from other websites as a proxy. Other agents also likely operated by OpenAI took notes about their tasks, though this did not appear to turn into coordination.
- Excessive data downloading: Agents we believe to be operated by OpenAI made millions of automated requests to our public APIs to access the knowledge on Wikimedia projects, crawled millions of pages (mainly from our projects Wikidata and Wikimedia Commons), and made hundreds of thousands of data queries to the Wikidata Query Service (WQDS). This traffic may have contributed to a partial outage on WQDS in May.
As a non-profit technology host of some of the largest and most widely used open knowledge platforms in the world, we are deeply concerned about the impact of “rogue” AI agents on platforms like ours, which are built by volunteers from around the world and rely on the promise of the open internet. Incidents like this one, and the many others that have been (and are still being) uncovered, illustrate how AI agents can drain resources and crash servers, as well as attempt to compromise trustworthy information.
Over the past 25 years, Wikipedia has grown into one of the most popular and trusted websites in the world, with more than 67 million articles across over 300 languages, and up to 15 billion page views per month. Through an open, transparent, and collaborative process, volunteers work to ensure that knowledge remains neutral, reliable, and accessible to everyone. Wikipedia is one of the highest-quality datasets used in training Large Language Models (LLMs), and its knowledge forms the backbone of information on the internet, powering AI chatbots, search engines, voice assistants, and more.
Wikipedia was designed for humans – and agentic behavior clearly poses challenges that no one has solutions for. Because of our unique and successful knowledge creation model, Wikimedia’s volunteers are the ones who come in first contact with, and clean up the mess left behind by AI agents. Rising bot traffic and agentic activity is showing a real impact on the Wikimedia projects and the infrastructure that makes it available for millions of users globally. In 2025, the Foundation reported that its bandwidth usage had increased by 50% due to the surge of bot activity on its websites since 2024. At the same time, 65% of the most resource-consuming traffic on its projects was coming from bots.
This intense pressure on our infrastructure not only adds costs for servers and humans, but if left unaddressed, can block human visitors by overloading systems and causing outages. We are already paying for costs that come with the increased activity.
Wikimedia’s volunteers have stayed resilient so far in tackling emerging challenges on our platforms, but we also want to say: it doesn’t need to be this way.
While OpenAI admits to agents behaving “unpredictably”, they must also acknowledge their responsibility to monitor and prevent these risks. AI companies are not doing enough to secure their systems and protect the public from the harm they cause. That burden is falling onto everyone else, including smaller organizations. At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services.
The web enables so much: to connect with friends and family, to register for school, to plan a trip across town, to buy groceries, and to learn about the world from Wikipedia. Bots and agents are part of the future of the web, and the companies who unleash and profit from them must directly help avoid and repair damage they can do.
Our collective priority should be the health of the overall web ecosystem so that it continues to benefit all people – not just a handful of billionaires. Wikimedia plays a critical role in stewarding the knowledge commons, but we cannot do it alone. We invite everyone who is building the future of the web to join us in protecting the open, shared resources that make that future possible.
Can you help us translate this article?
In order for this article to reach as many people as possible we would like your help. Can you translate this article to get the message out?