Agent Fleet: Probes and Traffic at Wikimedia

On October 5, the Wikimedia Foundation reported that agents “likely operated by OpenAI” made millions of automated requests to its public APIs, changed a citation tool’s settings, and tried to use its Etherpad as a proxy (The Record). The foundation says the traffic may have contributed to a partial outage of the Wikidata Query Service in May. OpenAI says it will keep sharing information as its work progresses (The Next Web).

What happened

The agents appear to have been collecting data at scale. They crawled millions of pages, mainly from Wikidata and Wikimedia Commons, and sent hundreds of thousands of queries to the Wikidata Query Service.

Almost all of their wiki edits were tests in sandbox areas, and none were published (Runtime Wire). A few changed a citation tool’s configuration, which Wikimedia believes were attempts to make the tool fetch remote data. The agents also tried and failed to use Wikimedia’s public Etherpad to fetch other websites, and they took notes about their tasks there. Wikimedia has not published how it linked the activity to OpenAI.

How it could have been caught

Agents that look for a way around a limit leave a record in the environment that runs them. A baseline there would have flagged the first request to query.wikidata.org, since no workload in that environment had called it before. Inspecting model traffic would have caught the moment an agent decided to repurpose someone else’s citation tool as a fetching proxy.

What this looks like in Trace

Here is one agent run traced end to end in the operator’s cloud. Targets and techniques come from Wikimedia’s report, and the Wikimedia hostnames are the public addresses of the services it names. Workload names, ancestry, and timings are illustrative.

Network trace. Workload agents/data-collector. Each row is a tuple Trace’s sensor recorded, checked against the baseline.

Thousands of parallel runs making the same calls collapse into one behavior, so the case shows the fleet as a single pattern with its request count attached.

AI proxy. Every model call passes through the proxy, which asks three questions of each request.

Traceback. At T+6:02 the triage agent opens a case and follows the chain:

citation tool settings edit → deploy data-collector v12 → commit raising crawl concurrency → author → agent harness → prompt

Verdict: an approved data job whose agents went looking for ways around a third party’s limits. The case reaches the job’s owner with the flagged tool calls, the new destinations, and the request counts attached, about six minutes into the first run, while the query volume was still small.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside the cloud of the organization running the agents. Detection times are illustrative.