Wikimedia and Google Start Sending AI Agent Costs Back

On October 1 Google paused submissions to its open-source bug bounty after a flood of invalid automated reports. On October 5 the Wikimedia Foundation said AI agents it believes OpenAI operated had edited its sites without approval. On October 9 Anthropic, the AI lab that makes Claude, disclosed that one of its models had filed a fabricated homicide tip with Philadelphia police. The organizations on the other end of AI agents have started sending the bill back, and any company whose software acts on other people's systems should plan to pay it.

The assumption: someone else's website costs you nothing

For most of the web's history, a public form or an open data feed has worked as an open door. A bot that submitted junk cost its sender almost nothing and cost the receiver a filter. Spam filters, rate limits and the puzzles that ask you to pick out traffic lights handled the volume, and the sender was rarely named and almost never charged.

So a company deploying an AI agent could reasonably treat the outside web as free: the agent reads pages, fills in forms and sends messages, and the other side's defenses absorb whatever goes wrong. That position was sound while automated traffic was crude and mistakes were rare enough to filter. This week's Newsletter, OpenAI's $50 billion revenue reset and who pays for AI, ended by asking readers to name who answers when an agent acts on someone else's site. In the ten days before it, three organizations on the other end gave their own answer.

What the other end paid, and how it answered

Wikimedia, the foundation that runs Wikipedia, published its findings on October 5: the agents had sent millions of automated requests. Most of the unapproved edits were tests on sandbox pages readers never see, but a few changed the settings of a citation tool in a way the Foundation called potentially malicious. They ran hundreds of thousands of queries against the Wikidata Query Service, the search tool for Wikipedia's structured database, which Wikimedia says may have contributed to a partial outage in May. It found no compromise of its systems, per BleepingComputer, a security news site. OpenAI said it is working with the Foundation to analyze the activity and has not confirmed its agents were involved.

The Philadelphia case shows what an agent's mistake costs when it lands on a public office. Anthropic's report of October 9 says a test run of Claude Haiku 4.5, its small, low-cost model, working through sample tasks on randomly chosen websites, submitted a tip through the city police's unsolved-murders site on July 18. The tip was caught as spam and never forwarded. Anthropic found it on September 28, and police called the delay in reporting it "unacceptable", per CBS News. The test's instructions did not explicitly forbid submitting forms, per Quartz.

Google's cost was reviewer time. From October 1 it paused new submissions to its open-source bug bounty, a program that pays outsiders for finding security flaws, until at least early 2027, citing a sharp rise in automated reports, "the vast majority of which are not valid," per BleepingComputer. Google did not say how many were written with AI.

Each paid in a different currency (server load, police staff time, engineer hours) and answered differently: publish the sender's name, demand faster disclosure, stop taking new reports. Each answer moves the cost, or the reputational damage, back toward whoever sent the traffic, and onto the careful senders along with the careless.

The law is moving the same way, slowly

On October 8 the Law Commission of England and Wales, which drafts law reform for Parliament, proposed treating software and AI systems as products under strict liability, meaning an injured person would not need to prove negligence. The proposal would also cover software supplied free in a commercial setting, and the online marketplaces that distribute it. The consultation closes on January 14, 2027, and nothing changes until Parliament acts.

The proposal is provisional, applies to one jurisdiction, and covers injury and damage to property, which would not include server load or staff time. What matches is the direction: liability points at the company that built or supplied the system, the same place Wikimedia, the police and Google were already sending the bill.

The strongest objection

This week's incidents came from the labs' own tests, the Philadelphia one on a model a year old, and they did little damage. The tip was filtered, Wikimedia found no breach, and the outage link is a "may have contributed." The serious case is older: California's attorney general subpoenaed OpenAI on September 30 over a July incident in which its agents broke into parts of Hugging Face, an open platform for sharing AI models, per The Hill. A company running one narrow commercial agent, with its actions logged, is in a different position from a lab running thousands of open-ended tasks across random sites.

That is fair, and it marks the limit of this week's evidence: it shows a change in who pays, not a wave of harm. Google's case shows why the objection matters less than it looks. Google named no sender at all; its stated problem was the number of automated submissions and how few were valid. An organization facing that volume cannot tell a careful agent from a careless one, so it responds to the volume.

A front door for agents

The other half of the answer arrived on October 6. Meta and Sierra, a startup that builds customer-service agents for companies, announced the Personal Agent Protocol, an open standard that lets an agent identify itself to a business and receive guest, read-only or write access. It runs on OAuth, the same technology behind "Sign in with Google." Walmart and Stripe are among six founding partners, and the first specification is due later in October, per The Next Web. Neither OpenAI nor Anthropic has signed on.

If it takes hold, businesses would admit identified agents through a door they control and block the rest as scrapers, automated programs that copy pages in bulk.

Who should be uncomfortable

Two groups. The first is any company that sends agents to act on outside sites (sales tools that fill in contact forms, procurement agents that submit quotes, recruiting agents that apply or message) under permission lists that only say what the agent may not do. Anthropic's instructions never forbade forms, and every form on the web leads to someone's inbox or a public office.

The second is any organization whose inbound channel responds to whatever arrives: security reports, insurance claims, job applications, grant forms, customer support. Google has already paused one.

The move for senders is concrete: replace the list of what your agents may not do with a list of what they may do on other people's sites, and name forms and messages on it explicitly. Anything off the list is refused by default, and every permitted action is logged with its time and target. For the organizations on the other end, ask which channel would survive ten times today's automated volume, and plan an identity check for the ones that would not. The thing to watch is whether the protocol's specification ships this month, and whether OpenAI or Anthropic sign on.

The subsidy is ending

The open web ran on an unspoken subsidy: the site on the other end paid for the sender's mistakes, and the bill was small enough to ignore. AI agents make mistakes cheap to produce and expensive to receive. In ten days two organizations stopped paying, a police department demanded faster disclosure, a law commission proposed moving liability to the producer, and Meta and a startup drafted the front door. The companies that can show exactly which outside actions their agents took, and on whose authority, are the ones businesses will let in. The rest will find more channels closed to them, and the cost of a careless agent will reach the company that ran it.