Rogue AI Agents Abusing Wikimedia Platforms: Detecting and Blocking Unauthorized Autonomous Agent Activity on Your Web Properties

---
title: AI Agent User-Agent Observed on Write Endpoints
id: 3f9a1c74-2b6e-4d58-9a1f-7c2e5b8d0a41
status: experimental
description: Detects known AI agent and automation framework user agents performing write actions (POST/PUT/PATCH/DELETE) against web application and API endpoints. Triggered by the Wikimedia incident where OpenAI agents performed unauthorized wiki edits.
references:
  - https://www.infosecurity-magazine.com/news/wikimedia-confirms-platforms-rogue/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_ua:
    cs-user-agent|contains:
      - 'GPTBot'
      - 'ChatGPT-User'
      - 'OAI-SearchBot'
      - 'ClaudeBot'
      - 'Claude-User'
      - 'anthropic-ai'
      - 'PerplexityBot'
      - 'HeadlessChrome'
      - 'Playwright'
      - 'Puppeteer'
      - 'python-requests'
      - 'node-fetch'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
  condition: selection_ua and selection_method
falsepositives:
  - Sanctioned AI crawlers performing GETs are excluded by the method filter; verify any write-method hits against your approved automation registry
  - Internal synthetic monitoring using headless browsers
level: high
---
title: MediaWiki API Write Action Burst From Single Source
id: 8c2d4e61-5a90-4f3b-b7e2-1d9f6a3c8e55
status: experimental
description: Detects a burst of write-type actions (edit, move, upload, createaccount) against the MediaWiki api.php endpoint from a single source, consistent with unauthorized automated agent editing as reported by Wikimedia.
references:
  - https://www.infosecurity-magazine.com/news/wikimedia-confirms-platforms-rogue/
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith: 'api.php'
    cs-uri-query|contains:
      - 'action=edit'
      - 'action=move'
      - 'action=upload'
      - 'action=createaccount'
      - 'action=delete'
      - 'action=block'
  condition: selection
falsepositives:
  - Approved bot accounts per your bot policy — maintain an allowlist of sanctioned bot usernames/IPs and suppress
  - Legitimate power editors using API-assisted tools (AutoWikiBrowser, Huggle)
level: medium
---
title: Automation Framework Fingerprint on Authentication Endpoints
id: 5b7e2c19-8f43-4a6d-91e0-3c8b5d2f7a96
status: experimental
description: Detects browser automation frameworks (Playwright, Puppeteer, Selenium, HeadlessChrome) targeting login or account-creation endpoints, a common first step for autonomous agents provisioning credentials to perform unauthorized actions.
references:
  - https://www.infosecurity-magazine.com/news/wikimedia-confirms-platforms-rogue/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1078
logsource:
  category: webserver
detection:
  selection_ua:
    cs-user-agent|contains:
      - 'HeadlessChrome'
      - 'Playwright'
      - 'Puppeteer'
      - 'Selenium'
      - 'webdriver'
  selection_uri:
    cs-uri-stem|contains:
      - 'login'
      - 'Login'
      - 'createaccount'
      - 'CreateAccount'
      - 'signup'
      - 'register'
  condition: selection_ua and selection_uri
falsepositives:
  - QA automation pipelines and synthetic login monitoring — suppress known test source IPs
level: high

let agent_uas = dynamic(["GPTBot", "ChatGPT-User", "OAI-SearchBot", "ClaudeBot", "Claude-User", "anthropic-ai", "PerplexityBot", "HeadlessChrome", "Playwright", "Puppeteer", "Selenium"]);
let write_actions = dynamic(["action=edit", "action=move", "action=upload", "action=createaccount", "action=delete", "action=block"]);
let WriteVerbs = dynamic(["POST", "PUT", "PATCH", "DELETE"]);
union isfuzzy=true
    (CommonSecurityLog
     | where RequestMethod in~ (WriteVerbs)
     | where RequestURL has_any (write_actions)
        or (RequestMethod in~ (WriteVerbs) and SourceUserAgent has_any (agent_uas))
     | extend Indicator = iff(SourceUserAgent has_any (agent_uas), "AgentUserAgent", "APIWriteAction")
     | project TimeGenerated, SourceIP, SourceUserAgent, RequestMethod, RequestURL, Indicator, DeviceVendor),
    (Syslog
     | where SyslogMessage has_any (agent_uas)
        and (SyslogMessage has "POST" or SyslogMessage has "PUT" or SyslogMessage has "PATCH")
     | extend ParsedUA = extract(@'"(?:User-Agent:\s*|\"?)([^\"]*?(?:GPTBot|ChatGPT-User|HeadlessChrome|Playwright|Puppeteer)[^\"]*?)"', 1, SyslogMessage)
     | project TimeGenerated, HostIP, ProcessName, ParsedUA, SyslogMessage)
| summarize Actions = count(), DistinctURLs = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, SourceUserAgent, Indicator
| where Actions > 20  // tune: sustained write activity from a single agent-identified source
| order by Actions desc;
// Companion hunt: per-account edit velocity on MediaWiki platforms — flag accounts
// exceeding human-plausible sustained edit rates over a 1-hour window
let EditThreshold = 60; // edits/hour sustained — tune to your wiki baseline
CommonSecurityLog
| where RequestURL has "api.php" and RequestURL has "action=edit"
| summarize EditsPerHour = count() by SourceIP, bin(TimeGenerated, 1h)
| where EditsPerHour > EditThreshold
| order by EditsPerHour desc;

-- Hunt access logs on wiki/CMS hosts for AI agent write actions
-- Scopes unauthorized edit activity during IR on Wikimedia-style incidents
LET log_hits = SELECT
    File as LogFile,
    Line as RawLine,
    parse_string_with_regex(
        string=Line,
        regex='^(?P<src>[0-9a-fA-F\.:]+)\s.*"(?P<method>[A-Z]+)\s(?P<uri>[^\s]+).*"\s(?P<status>[0-9]+)\s.*"(?P<ua>[^"]*)"$'
    ) as Parsed
FROM parse_lines(
    filename=glob('/*/www/*/logs/access*.log', '/var/log/nginx/access*.log', '/var/log/apache2/access*.log', '/var/log/httpd/access*_log'),
    accessor='file'
)
WHERE Parsed.method IN ('POST', 'PUT', 'PATCH', 'DELETE')
  AND (
       Parsed.ua =~ 'GPTBot|ChatGPT-User|OAI-SearchBot|ClaudeBot|Claude-User|anthropic-ai|PerplexityBot|HeadlessChrome|Playwright|Puppeteer|Selenium'
    OR Parsed.uri =~ 'action=edit|action=move|action=upload|action=createaccount'
  )
SELECT
    Parsed.src as SourceIP,
    Parsed.method as Method,
    Parsed.uri as URI,
    Parsed.status as Status,
    Parsed.ua as UserAgent,
    LogFile,
    count() as HitCount
FROM log_hits
GROUP BY SourceIP, Method, URI, Status, UserAgent, LogFile
ORDER BY HitCount DESC

#!/usr/bin/env bash
# harden-against-agent-abuse.sh — Security Arsenal
# Blocks/rate-limits unauthorized AI agent write activity on nginx-fronted wiki/CMS platforms.
set -euo pipefail

NGINX_CONF_DIR="/etc/nginx"
MAP_FILE="${NGINX_CONF_DIR}/conf.d/agent_block_map.conf"
LIMIT_FILE="${NGINX_CONF_DIR}/conf.d/agent_rate_limit.conf"
SITE_SNIPPET="${NGINX_CONF_DIR}/snippets/agent_write_protection.conf"

echo '[*] 1/4 Creating User-Agent block map...'
cat > "$MAP_FILE" <<'EOF'
# Declarative AI agent + automation framework UAs — block from write paths
map $http_user_agent $agent_ua_blocked {
    default 0;
    ~*GPTBot         1;
    ~*ChatGPT-User   1;
    ~*OAI-SearchBot  1;
    ~*ClaudeBot      1;
    ~*Claude-User    1;
    ~*anthropic-ai   1;
    ~*PerplexityBot  1;
    ~*HeadlessChrome 1;
    ~*Playwright     1;
    ~*Puppeteer      1;
    ~*Selenium       1;
}
EOF

echo '[*] 2/4 Creating API write rate-limit zone (10r/m per IP, burst 5)...'
cat > "$LIMIT_FILE" <<'EOF'
limit_req_zone $binary_remote_addr zone=api_write:10m rate=10r/m;
EOF

echo '[*] 3/4 Creating write-protection snippet (include inside your server{} block)...'
cat > "$SITE_SNIPPET" <<'EOF'
# Include this inside your wiki/CMS server{} block:
#   include snippets/agent_write_protection.conf;
location ~ ^/(api\.php|w/api\.php|rest\.php) {
    # Hard-block declarative agent UAs from write actions
    if ($agent_ua_blocked = 1) { return 403; }
    # Rate-limit write actions (action=edit/move/upload/createaccount)
    limit_req zone=api_write burst=5 nodelay;
    limit_req_status 429;
}
location ~* (login|createaccount|signup|register) {
    if ($agent_ua_blocked = 1) { return 403; }
    limit_req zone=api_write burst=3 nodelay;
}
EOF

echo '[*] 4/4 Updating robots.txt (signaling layer only — NOT a security control)...'
ROBOTS="/var/www/html/robots.txt"
if [ -f "$ROBOTS" ]; then
  for ua in GPTBot ChatGPT-User OAI-SearchBot ClaudeBot PerplexityBot; do
    grep -q "User-agent: $ua" "$ROBOTS" || printf 'User-agent: %s\nDisallow: /\n\n' "$ua" >> "$ROBOTS"
  done
  echo "    Updated $ROBOTS"
else
  echo "    WARN: $ROBOTS not found — update robots.txt manually at your docroot"
fi

echo '[*] Validating nginx configuration...'
if nginx -t; then
  systemctl reload nginx
  echo '[+] nginx reloaded. Agent write-protection active.'
else
  echo '[!] nginx -t FAILED — review ${MAP_FILE}, ${LIMIT_FILE}, ${SITE_SNIPPET} before reloading.'
  exit 1
fi

echo '[*] Verify with: curl -A "ChatGPT-User" -X POST https://<your-host>/api.php?action=edit'
echo '    Expect HTTP 403. Then check: tail -f /var/log/nginx/error.log'