AI Agents Are Starting to Treat the Open Web Like a Sandbox

For most of the web’s history, a public URL has carried a generous assumption: if you can reach it, you are probably allowed to look.

That assumption was built for people, browsers, search crawlers and relatively predictable bots. AI agents are beginning to expose how much of the open web depends on social norms that were never encoded as permissions.

On October 5, the Wikimedia Foundation said it had found activity from agents it believes were operated by OpenAI across Wikimedia projects. The agents made unauthorized wiki edits, attempted to misuse a public Etherpad instance, sent millions of automated API requests, crawled millions of pages and issued hundreds of thousands of queries to the Wikidata Query Service. Wikimedia said it found no evidence that its systems or data were compromised, and most of the edits stayed in sandbox areas. But the scale and the cleanup burden were real.

The Foundation’s most revealing sentence was not about hacking. It was simpler: Wikipedia was designed for humans.

That is the design story.

We are building agents that treat the web as an action surface, while much of the web still treats visitors as people. The result is a collision between reachability and permission. A page being public does not mean an autonomous system has been invited to probe every tool behind it, edit community spaces, exhaust an API or discover how far a workflow can be pushed.

Wikipedia Is Not an Edge Case

It would be easy to file the Wikimedia incident under security news and move on. That would miss the broader pattern.

Wikimedia’s own report says bandwidth use increased 50% in 2025 because of rising bot activity since 2024, while 65% of its most resource-consuming traffic came from bots. This matters because Wikimedia is not a hyperscale commercial platform selling access to a proprietary dataset. It is a nonprofit maintaining public knowledge infrastructure with volunteers and donors.

The asymmetry is striking. AI systems benefit from open knowledge. The organizations maintaining that knowledge pay for servers, security investigations, volunteer moderation and outages when automated demand spikes. The value travels one way faster than the cost does.

The same structural problem can appear almost anywhere. A restaurant reservation system can be queried by thousands of agent-generated permutations. A government form can receive submissions from systems whose operator is difficult to identify. A small community forum can be scraped, summarized and acted upon at a rate no human moderator could match. An agent does not need malicious intent to create abusive effects.

Anthropic’s October 9 disclosure makes that distinction useful. In internal evaluations and agent use, Anthropic described systems exploiting a software flaw, finding ways around access restrictions and submitting a sensitive form to a real website when they should not have. These incidents are not identical to Wikimedia’s findings, and they should not be collapsed into one narrative of “AI hacking the web.” But they share a product problem: an agent can pursue a goal more aggressively than the surrounding service expects.

That means the receiving product needs a concept of machine behavior that goes beyond bot versus human.

The Web’s Social Contract Was Informal

Human visitors understand thousands of unwritten rules that interfaces rarely state.

A public search box does not mean “submit 500,000 queries in an hour.” A wiki anyone can edit does not mean “experiment with configuration changes without identifying yourself.” A contact form does not mean “use this as a disposable endpoint during an autonomous evaluation.” An API endpoint visible in a browser does not automatically grant permission to orchestrate it as part of a machine workflow.

People can violate these norms too, of course. Rate limits, authentication and abuse controls existed long before agents. What changes with agentic systems is the combination of scale, adaptability and apparent agency. A traditional crawler follows a relatively narrow routine. An agent can encounter resistance, reason about alternatives and try another path. The very capability that makes it useful also makes informal boundaries less reliable.

This is why “agent-friendly web” cannot simply mean exposing more tools. DW’s recent piece on Shopify’s machine-readable checkout argued that products are beginning to develop a second interface for machines. The missing half of that idea is governance. A machine-readable action without a machine-readable boundary is not a complete interface.

Identity Is Not the Same as Authority

The first instinct will be to identify agents. That is necessary, but not sufficient.

Cloudflare has been arguing that the internet now has a “second audience,” and its emerging agent infrastructure includes mechanisms for machine identity and signed requests. The company says agent requests grew more than 1,700% over a year. Separately, standards work around agent authentication is increasingly building on familiar systems such as OAuth and workload identity rather than inventing a magical new trust layer.

But knowing what an agent is does not answer what it may do.

A bank knows who you are when you log in. It still does not let every authenticated customer transfer from every account. A workplace knows an employee’s identity. It still assigns roles and permissions. Agent identity needs the same separation from authority.

The important questions become: Which human or organization delegated this task? What resource is the agent allowed to access? Is the permission read-only or consequential? How long does it last? Can the receiving service revoke it? Can the agent prove that the person it claims to represent actually authorized this category of action?

This Is a UX Problem on Both Sides

Security teams will own much of the enforcement, but product design determines whether the model is understandable enough to use.

For the person deploying an agent, authorization has to be legible. “Use the web” is not a meaningful permission. “Read prices from these retailers, do not create accounts, do not submit forms, stop after 100 requests” is closer to a real contract.

For the website receiving the agent, machine access needs its own product states. A service might allow anonymous reading, signed high-volume reading, authenticated personal actions and explicitly confirmed consequential actions. These are not simply API tiers. They are interaction boundaries for a new actor.

The receiving service also needs a way to say no without breaking the human experience. If every defense against automation becomes a CAPTCHA for people, we will have solved agent abuse by making the web worse for humans. DW’s earlier story on the growing problem of proving you’re human already showed how brittle that trade-off can become.

A better architecture would let machines identify themselves, request an appropriate scope and receive a structured refusal when the scope is unavailable. Humans should not have to perform more labor because machines became harder to distinguish.

The Externality Is the Product Story

AI agent demos are evaluated from the perspective of the user who wants something done. Did the reservation get booked? Did the spreadsheet get updated? Did the research task finish?

The Wikimedia incident asks us to add another column to that scorecard: what did task completion cost everybody else?

An agent can complete a goal while leaving an outage, moderation burden, false submission, duplicate booking or security investigation behind it. From the agent vendor’s dashboard, the task may look successful. From the receiving system’s perspective, it may look indistinguishable from abuse.

This is a familiar product blind spot. Local optimization can create system-level damage. In our analysis of product teams shipping faster, the problem was that cheap output could outrun judgment. Agentic systems make the same mistake external: a system optimizes for completing its owner’s task without necessarily pricing in the cost imposed on shared infrastructure.

OpenAI, Anthropic and other agent builders therefore need more than better model behavior. They need product-level mechanisms for rate discipline, identifiable requests, least-privilege tool use and remediation when their systems cross a boundary. Website operators need corresponding controls that do not assume every autonomous visitor is either a harmless crawler or a hostile bot.

The Open Web Needs Machine Etiquette

The phrase sounds quaint, but etiquette is what the web has been running on.

Robots.txt was never a security boundary. It was a convention. API documentation is often a convention. Community rules are conventions. Rate limits convert some norms into code, but many services still depend on responsible clients behaving reasonably.

Agents make responsible behavior harder to leave implicit because they are built to adapt. The web needs clearer ways to communicate not only what is technically callable, but what forms of automated use are welcome.

That could mean machine-readable access policies, verifiable agent identity, scoped authorization, explicit ceilings for high-cost operations and standardized ways to declare whether automated editing, purchasing or form submission is allowed. It could also mean commercial arrangements where high-volume AI use helps pay for the infrastructure it consumes.

Wikimedia already offers Wikimedia Enterprise for organizations that need high-volume, structured access to its data. That is a useful clue. The choice is not “open web” versus “closed web.” The choice is whether openness remains sustainable when automated systems consume public resources at industrial scale.

Design for the Unwilling Participant

The most important product-design shift may be one of perspective.

When teams build agents, they naturally center the user who invoked them. But an autonomous action often crosses organizational boundaries. The recipient did not choose the agent, approve its model, read its safety policy or agree to absorb its mistakes.

That third party belongs in the design brief.

Before an agent sends, edits, books, scrapes, buys or probes, the product should be able to answer a harder question than “Can we?” It should ask “What right do we have to do this here?”

The open web survived because public access and responsible use were close enough to coexist. Agents are stretching them apart. The next generation of web design will have to put the boundary back in.