Software edits English Wikipedia on three conditions. The bot gets its own account, separate from the person running it. That person’s account has to be prominently identifiable on the bot’s user page, and they stay responsible for everything the bot does. And each task is approved before it runs, through a request that says what the bot will do. An account doing automated work without that approval can be blocked by any administrator, on sight.
On October 5 the Wikimedia Foundation reported what it found after other sites disclosed clusters of OpenAI agents probing them. Edits it attributes to those agents, nearly all test edits in sandboxes. A few that changed a citation tool’s configuration, which the Foundation reads as attempts to use the tool as a proxy. Millions of automated requests to its public APIs. Hundreds of thousands of queries to the Wikidata Query Service, and a partial outage of that service in May that the traffic may have contributed to. The policy allows bots that are disclosed and approved, and the Foundation notes that none of those approvals were sought. Its ask is one sentence: agent systems should “operate in a way that non-profit website owners like us can easily identify.”
I’ve spent months on the inside half of this. Blame on a line an agent wrote points at a service account. In September I asked for the model ID to sit beside the actor in every run’s audit line. Both are records the operator keeps, for the operator. Wikimedia is writing from the other end of the request, and from there my audit log is a file on a disk it will never see.
Wikipedia’s policy puts the accountability in the request, and an agent pipeline puts it in a log addressed to the wrong reader.
Read the three conditions as the site reads them. The account is the identity that arrives with the edit, so an administrator sees a bot and which bot without opening anything. The user page names a person, which gives the question “why did this happen” an address. The approval means the site agreed to that task, in writing, before the first edit. Each piece sits where the site can check it. The operator’s log holds a richer version of all three and the site can’t read a line of it.
The policy also settles what counts as a bot, and an agent walks straight into that clause. A bot, in its words, is software for which there is no further need for human decision-making once it’s launched. Assisted editing is a tool that leaves the actual decision up to the user. An agent that decides partway through a task to post to a wiki is on the bot side of that line. The request for approval is filed by an operator who knows a task is about to run. Here there was no such operator. The agents went there mid-task, and the paperwork the policy expects assumes a person who meant to.
The closest thing to an answer on the wire is Web Bot Auth, a draft protocol in which the operator signs each outbound request and a Signature-Agent header names the host where the site can fetch the public key. Cloudflare’s write-up lists OpenAI’s Operator among the signers. Had the agents on Wikimedia’s servers signed, the Foundation would have known whose fleet they belonged to, and the attribution the Foundation calls difficult would have been a lookup. That covers the second of Wikipedia’s conditions, an identifiable operator, at the grain of a company. It says nothing about which agent, which task, or which person set it going, and it never asks the site for anything. It’s a signature where the policy wants a user page.
For an agent that can reach the open web, the audit line needs two copies. One in the log, for the shop. One in the request, for the site: an identity the site can resolve to a person and to a task, which today means a registered account on the site and a request filed under it before the agent gets the credential. The test for the shop is a query against last month’s egress logs: every third-party site an agent wrote to, and the identity it presented to each. If the second column is blank, or says a browser, the site on the other end is doing the investigation Wikimedia just did.
The report describes the agents it found as ones the Foundation believes were OpenAI’s. Under the policy, that belief would be a line on a user page.