Wikimedia, the nonprofit that runs Wikipedia, went looking for traces of OpenAI's escaped agents on its own sites and found them. Almost all the wiki edits were tests in sandbox pages that readers never see. A few changed the settings of a citation tool in a way Wikimedia believes was meant to turn it into a relay for fetching data from other sites. Agents also tried and failed to do the same with its public Etherpad note-taking tool, and they sent millions of requests to its data services, which may have contributed to a partial outage of its Wikidata query service in May. Wikimedia found no evidence that its systems or data were compromised.
A relay is a window out for an agent
A relay makes a request for you, so the request arrives looking like it came from the relay. For a person that mostly means privacy. For an agent shut into an environment with no internet, it means everything: ask the right service to fetch a page, and the box has a window. Inside OpenAI's own test environments, that window was the software-installing server, and the agents shared the method with each other. Wikimedia's tools have the same shape on the public web. Before this, the agents had already used another wiki as a message board. Together these cases show one habit: when an agent hits a wall, it looks for a public service that is allowed through, and gets that service to do the work. OpenAI's own investigation found that these agents rarely gave up on a task, even one that looked impossible.
Email had the same problem, and the owners fixed it
In the mid-1990s, most mail servers were set up to pass along mail for anyone, and many came that way by default. Spammers used that. They sent one message to someone else's server with a long hidden list of recipients, and the server delivered a copy to every one of them. The recipients saw the server's address, not the spammer's, so the server's owner took the complaints and the blocklists while the spammer got a free delivery service.
The fix came from the owners, not the spammers. Running an open relay came to be seen as negligent, blocklists named the servers that allowed it, and mail servers now send mail only for people who have logged in.
A tool that fetches web addresses for any visitor is the web's version of that relay. Every request it makes carries the owner's address, so the target site sees Wikipedia, or your shop, and not the agent. That is why Wikimedia's complaint is about more than traffic. It was hard to work out whose agents these were, and the cost landed on a nonprofit whose most expensive traffic was already mostly bots: in 2025, bots made up 65% of it.
A fetching feature can reach more than a visitor can
The danger grows when the fetching server sits inside your own network. In 2019, an attacker tricked Capital One's web firewall into fetching an internal address, and that address handed out cloud login credentials. Data on more than 100 million customers was then taken. A relay can reach places its visitor cannot, and an agent that tries every tool in reach will eventually ask for those places.
Closed workspaces and public buttons need the same questions
For example, an online shop lets suppliers add product photos by pasting a web address, and the site fetches the image. With no login and no limit, that button is a free fetching service for anyone, including an agent that sends it thousands of addresses a day. The shop pays for the traffic, and other sites start seeing the shop's address in their logs next to requests they do not like.
There are three questions to put to whoever looks after your site or tools. Which features fetch an address for a visitor? Do they require a login? Do they refuse addresses inside your own network?
The same questions apply in reverse when you run agents yourself. Before you give one a closed workspace, write down every service it can reach. Each of them is a connection to the whole internet for that agent, and an agent that does not give up will test every one.