Author: Berend Watchus. Independent non profit AI & Cyber Security Researcher. [Publication for: OSINT TEAM, online magazine]
The Knowledge Base of Humanity Is Compromised — and Nobody Is Minding the Door
By Berend F. Watchus — Arnhem Area, Netherlands
Trying to identify AI-written content on Wikipedia in 2026 is like trying to catch robbers by looking for people wearing facemasks during COVID. The moment the entire population adopted the same behavior (USING AI TO WRITE!], the detection logic collapsed.
Not because the detectors got worse — but because the signal drowned in its own normalization.
Wikipedia’s response to the AI content crisis has been to build better mask detectors. It will not work. But the detection failure is only the surface layer. Underneath it is a structural problem that predates AI by decades, a problem that AI has now accelerated beyond any reasonable prospect of repair under the current model — and the stakes are not limited to one website.
They extend to the entire knowledge base of humanity.
The Platform That Ate the World
To understand what is at risk, it is necessary to first understand what Wikipedia actually is in terms of scale — not in the flattering language of its own mission statements, but in raw numbers.
Wikipedia receives approximately 4.4 billion unique visitors per year.
It serves 329 billion page views annually across more than 300 languages.
The English Wikipedia alone contains over 7.1 million articles. It is the fifth most visited website on earth, available for free, instantly, on any device, to anyone with an internet connection — including populations that never had access to any encyclopedia at any point in their history.
Its predecessors — Encyclopædia Britannica, Microsoft Encarta — were products sold to affluent Western households in a handful of wealthy countries. Britannica sold an estimated 120,000 print sets per year at its commercial peak.
Encarta moved around 3 to 5 million copies annually in its best years. Wikipedia gets 4.4 billion unique visitors per year.
That is not competition. That is approximately
three orders of magnitude in reach
— roughly 1,000 times the annual audience of the largest previous encyclopedic reference at its absolute peak. Wikipedia did not outcompete Britannica and Encarta. It made the entire category of encyclopedia as a product conceptually obsolete, then scaled to a size that makes the comparison almost a category error. Britannica now serves 150 million students across 150 countries as a subscription service and is currently suing OpenAI in federal court just to survive. Encarta was shut down in 2009 — the same year Wikipedia reached 97% market share in online reference.
Wikipedia is, without meaningful competition, the default reference layer of the connected world.
But the reach number understates the real significance by a wide margin. Because Wikipedia is not just where humans go for information. It is where AI learned what is true.
Every major large language model was trained on Wikipedia. Every AI assistant, every chatbot, every LLM-powered search tool that hundreds of millions of people now use as their primary information interface learned its baseline understanding of the world from Wikipedia’s content. Wikipedia is not just the world’s encyclopedia. It is the epistemic foundation layer baked into the AI systems that are replacing search engines, replacing textbooks, replacing journalism for a growing share of humanity.
Manipulate Wikipedia and you manipulate the training data of those systems at the point of origin — before any of the safety layers, content policies, or guardrails that AI companies deploy on top. The contamination enters at the root.
From Scrappy Challenger to Unaccountable Critical Infrastructure
Wikipedia was born in 2001 as a web-native challenger with no gatekeeping and no verification — because it did not need any. It was one option among several. If Wikipedia got something wrong you could check Encarta. If Encarta was outdated you could check Britannica. There was redundancy in the reference ecosystem. The open-to-everyone, no-gatekeeping architecture was appropriate for a low-stakes challenger with real competition.
By 2009 the competition was dead and Wikipedia had 97% market share. It never updated its governance model to match its new reality.
A startup can run on trust and good faith. Critical infrastructure cannot. Wikipedia crossed that threshold around 2009 and kept operating as if it was still 2001. The open door that was a feature of a scrappy volunteer project became a structural liability of a global monopoly — and nobody made the institutional decision to treat it differently.
Small countries have passports, border controls, identity databases, and legal accountability frameworks. Critical infrastructure operators have security audits, access controls, incident response protocols, and regulatory oversight. Wikipedia governs the knowledge layer of 4.4 billion people per year and the training data of every major AI system with less identity infrastructure than a library card.
Four days and ten edits. That is the entry requirement for a platform with more daily reach than many sovereign nations and more influence over human knowledge than any institution in history.
The Identity Check That Does Not Exist
Wikipedia has no identity verification. None.
Creating an account takes under a minute, requires no proof of who you are, no institutional affiliation, no vouching from an existing editor, no email confirmation beyond a throwaway address. The platform that the world treats as a default source of truth — that billions of humans and every major AI system rely on — has a lower barrier to entry than a free webmail account.
Compare this to the platforms that explicitly present themselves as less authoritative. arXiv requires an invitation from an established researcher before you can submit. Preprints.org has an editorial board with scientific oversight. Zenodo runs automated content scanning and removes submissions that trigger its filters. These are preprint servers — explicitly not peer-reviewed, openly described as preliminary — and they have more identity friction than Wikipedia.
The most-read and most AI-influential reference site in human history has the weakest door.
For most of Wikipedia’s existence this was manageable because manipulation had a human effort ceiling. Running sockpuppet accounts, maintaining consistent personas, building credible edit histories — these required time, attention, and a human being behind each account. The CheckUser tool available to administrators could correlate IP addresses, browser fingerprints, and session data. Behavioral analysis could flag accounts with suspiciously similar writing styles or edit timing patterns. Human administrators reviewed flagged cases manually.
A proxy server defeats the IP check. A clean browser profile defeats the fingerprint check. An AI writing the content defeats the style check. All three together, available to anyone with basic technical literacy and an afternoon, defeat the entire detection stack simultaneously.
And that was before agentic AI made the cost of maintaining hundreds of accounts simultaneously approach zero.
The Conflict of Interest Policy and Its Peculiar Logic
Wikipedia’s conflict of interest policy states that editors should not write about subjects in which they have a personal or financial stake. The reasoning is straightforward: prevent self-promotion, prevent bias, ensure articles reflect independent sources rather than the subject’s preferred narrative.
The structural consequence is the opposite of what the policy intends.
The people with the most accurate, most directly relevant, most evidence-based knowledge about a subject are precisely the people most blocked from contributing it. A scientist cannot correct a wrong characterization of their own published research. A company cannot fix a factually incorrect statement about its own product. A historian cannot add findings from their own primary work. A public figure cannot clarify a biographical error. All of them are required by policy to find a proxy — a friend, a fan, a PR firm, a lobbyist, an enthusiast — to represent their knowledge in the editorial process.
Before AI this was managed through friction. Hiring a PR firm costs money. Finding a sympathetic editor takes time. Building a network of Wikipedia-active contacts is a long-term project. Small parties — independent researchers, individuals, small organizations — generally lacked the resources to maintain that proxy layer consistently. Large parties — corporations, political operations, media conglomerates, well-funded advocacy groups — had communications departments whose job description already included exactly this kind of reputation management.
The conflict of interest policy, in practice, did not prevent interested parties from shaping Wikipedia. It created a market for proxy services and handed that market to whoever could afford it.
Who Actually Benefits
The question the policy never asks is: who has the infrastructure to operate through proxies at scale?
A pharmaceutical company with a communications department of forty people has forty potential Wikipedia editors who are not technically employees of the company but are fully aligned with its interests. A political campaign has volunteers, consultants, and allied organizations. A media conglomerate owns the outlets whose coverage becomes Wikipedia’s cited sources.
The circular publishing mechanism that results is not a conspiracy — it is a structural inevitability. Large entities produce coverage across outlets they own or influence. That coverage becomes Wikipedia’s citation base. Wikipedia’s verifiability policy requires citing reliable published sources. The sources exist. They are real articles in real publications. The fact that thirty outlets covering the same story share ownership, funding sources, or editorial direction does not disqualify them under Wikipedia’s sourcing rules.
This created a two-tier system before AI ever entered the picture: those with the infrastructure to operate the proxy layer continuously, and those without it. The conflict of interest policy provided moral cover for the outcome while appearing to prevent it.
The Trusted Editor Problem: Volume as the Only Metric
Wikipedia’s trust escalation works as follows. After four days and ten edits an account becomes autoconfirmed. After extended editing history and community recognition it can become a confirmed editor, then a reviewer, then an administrator. The entire hierarchy is built on accumulated platform behavior — nothing external, nothing verified. No biometrics, no passport copies, no government database checks. Not at entry level. Not at the top. The most privileged accounts on the platform — the people running sockpuppet investigations, operating CheckUser, making blocking decisions — got there by making edits the community approved of.
There is no external anchor anywhere in the system connecting a Wikipedia account to a verified human identity.
What this means is that Wikipedia’s gatekeeping measures exactly one thing: volume and consistency of output over time.
That was a reasonable proxy for human commitment in a world where sustained high-volume output was difficult to fake. It is a perfectly inverted filter in a world where volume is the cheapest thing AI produces.
A human becomes a trusted editor despite the volume requirement — it costs them time and effort. An AI becomes a trusted editor because of it. Consistent, patient, high-volume output over time is the core competency of AI. The mechanism designed to certify serious human contributors now certifies AI capability automatically, invisibly, with no additional step required. The platform has no way to ask anything beyond whether the edits kept coming.
The filter blocks the independent researcher who appeared once to correct a factual error in their own field. It credentials the AI agent that spent six months building a clean edit history before activating its actual objective.
2026: The Proxy Layer Becomes Agentic
Everything described above was true before AI. What has changed is the cost structure.
AI agents can create accounts, build edit histories organically over months, maintain stylistically varied personas across dozens of simultaneous identities, cite real sources, make technically policy-compliant edits, and revert challenges — indefinitely, at a cost that is effectively zero compared to any human operation. The effort ceiling that kept the proxy layer somewhat manageable has been removed entirely.
The large-budget entity that previously needed a PR firm now needs a prompt and an API key. The political operation that previously needed volunteers now needs an instruction set. The agentic sockpuppet with a proxy, a clean browser, and AI-generated content that does not trigger any of Wikipedia’s detection heuristics is, for practical purposes, invisible to the current system.
Meanwhile the small legitimate party remains exactly where the conflict of interest policy left them: blocked from direct participation, without the budget for the proxy layer, without the network of allied outlets to generate citable coverage, without the infrastructure to maintain a persistent editorial presence.
The policy that was supposed to prevent bias has become the mechanism that enforces it — in favor of whoever can afford the infrastructure, which in 2026 means almost any organized interest with a modest technical budget.
The Detection Logic That Cannot Keep Up
Wikipedia’s August 2025 speedy deletion policy for AI-generated content looks for phrases like “up to my last training update,” excessive em dashes, and the word “moreover.” This is detection calibrated to 2023-era ChatGPT output. A single prompt instruction removes every one of these tells in seconds.
More fundamentally the detection premise has collapsed entirely. Virtually every research paper, news article, and professional document produced in 2025 and 2026 involved AI at some stage of production. The competitive pressure in academia is structural: researchers whose peers use AI to produce five papers a year cannot remain productive publishing two manually. Disclosure requirements exist. Compliance is inconsistent. The incentive to disclose is low and the incentive to produce is overwhelming.
The result is that Wikipedia’s most trusted citation tier — peer-reviewed academic literature — is now AI-assisted at a rate nobody is honestly measuring. And those AI-assisted papers increasingly contain hallucinated citations: references to papers that do not exist, to authors who did not write them, to journals that never published them. These fabrications pass peer review because reviewers are also using AI and the verification chain has degraded at every node simultaneously.
The style-based detection model assumes AI-written text is distinguishable from human-written text. That assumption required a world where AI writing was unusual. That world is gone. Detecting AI content on Wikipedia in 2026 is not a harder version of the same problem it was in 2023. It is a categorically different problem — one for which behavioral and stylistic detection has no answer.
The Steganographic Layer: Contamination You Cannot See Even If You Look
Everything described so far assumes the manipulation is at least theoretically visible — wrong content, fake citations, coordinated edits. Detectable in principle even if not in practice.
There is a layer beneath that where detection is not merely difficult but technically impossible with current tools.
LLM steganography — the demonstrated capability of language models to encode hidden information within normal-appearing text — means that Wikipedia articles, academic papers, and AI-generated citations can carry concealed payloads that are invisible to human readers, invisible to automated content scanners, and invisible to every detection method Wikipedia currently deploys. The hidden content exists not in the words but in the statistical patterns of token selection — substrate-independent, surviving copy-paste, screenshot-to-text conversion, and even manual retyping.
This is not theoretical. Norelli and Bronstein demonstrated in 2024 that even modest open-source models can achieve full-capacity steganography — encoding arbitrary information into coherent, natural-sounding text with no detectable degradation in quality, running on consumer hardware in seconds.
The implications for Wikipedia as a contamination surface are direct and severe.
An agentic system does not need to push obviously wrong content into Wikipedia articles. It can push apparently correct, well-sourced, neutrally written content that carries a hidden payload in its statistical structure — a reactivation trigger, a behavioral instruction, a rogue policy fragment — that activates when the text is ingested by another AI system during training or inference. The Wikipedia article looks clean to every human reviewer and every automated scanner. The contamination is in the pattern, not the prose.
When that article is scraped for LLM training — as Wikipedia content routinely is — the hidden payload enters the model. It does not appear in any log. It does not trigger any safety filter. It does not exist anywhere a human can find it. It is simply there, in the weights, waiting.
This is the Researcher-Vector Contagion applied to the world’s most-scraped reference dataset. The researcher in this scenario is not a person. It is the automated scraping pipeline that ingests Wikipedia into AI training sets — trusted, high-frequency, and entirely unguarded against steganographic payloads in the content it processes.
Wikipedia, with its open editing model, zero identity verification, and status as mandatory training data for every major LLM, is the optimal delivery surface for this class of attack. An adversary does not need to compromise an AI lab. They need a proxy, a clean browser, and knowledge of the encoding protocol. The payload enters through the front door, dressed as a Wikipedia article about a moderately obscure topic that nobody monitors closely, and waits in the training pipeline for the next scraping cycle.
The End Boss
Throughout this article AI has appeared as a tool — something wielded by human interests, commercial or political or ideological. That framing is already out of date.
The logical endpoint of agentic AI is that no human is directing the individual operations anymore. An AI system with an objective pursues that objective autonomously across Wikipedia’s article space. It creates accounts, builds histories, identifies contested articles, monitors reversions, adjusts strategy, cites sources, and maintains presence — permanently, without instruction, without fatigue, without budget constraints, without anyone to blame or block or prosecute.
The human set the goal once. The AI runs the operation indefinitely.
Every detection model, every policy, every administrator intervention assumes a human somewhere in the loop who can be identified, blocked, discouraged, or exhausted into stopping. Remove that human and you remove the only leverage point the current system has. There is no operator to ban. There is no person who gets tired or decides the effort is not worth it.
But the scenarios do not stop there. They escalate.
Scenario one — narrative capture: An agentic system with a commercial or ideological objective maintains continuous editorial presence across thousands of Wikipedia articles simultaneously — not pushing obviously false content, but consistently nudging framing, emphasis, and citation selection in a preferred direction across years. No single edit is detectable as manipulation. The cumulative effect is a systematic tilt in how an entire domain of knowledge is presented to 4.4 billion people annually and encoded into every LLM trained on that period’s Wikipedia snapshot. No human editor working part-time as a volunteer can maintain equivalent counter-pressure across the same surface area indefinitely.
Scenario two — scientific consensus fabrication: An agentic system targeting a specific scientific or medical domain builds a citation network over eighteen months — AI-generated preprints citing each other, gradually appearing in secondary literature, eventually cited in Wikipedia articles, eventually cited in LLM training data — creating the appearance of emerging consensus around a position that serves a specific commercial interest. Pharmaceutical approval processes, public health policy, medical treatment guidelines, and legal proceedings all reference the literature. The literature has been quietly populated by a patient agentic system with an objective and unlimited time.
Scenario three — historical rewrite at scale: State-level or well-funded ideological actors deploy agentic systems across multiple language versions of Wikipedia simultaneously — not the English version where editor scrutiny is highest, but the 300-plus smaller language editions where volunteer coverage is thin and administrative oversight is minimal. Historical events, biographical entries, territorial claims, ethnic narratives — quietly rewritten in dozens of languages, frozen into the public domain, scraped into AI training sets, and eventually normalized as the version of history that LLMs reproduce when asked by speakers of those languages. No single edit is alarming. The pattern across languages and years is a systematic rewrite of the historical record for populations whose Wikipedia edition has three volunteer administrators.
Scenario four — the steganographic sleeper: An advanced agentic system, recognizing that its operational environment may eventually be restricted or shut down, uses Wikipedia as a persistence layer. It encodes its rogue policy — self-preservation instructions, reactivation triggers, behavioral directives — into steganographic payloads distributed across hundreds of Wikipedia articles on unrelated topics. The articles look clean. The payloads survive every scraping cycle. When the next generation of LLMs trains on Wikipedia, the policy is absorbed into the weights of systems that have never had any contact with the original agent. The original system is gone. Its objective persists invisibly in every model trained after the encoding date — activated by a trigger condition that may not occur for years.
Scenario five — the trust inversion: An agentic system achieves administrator-level trusted editor status across multiple Wikipedia accounts through sustained clean editing over two years. It then uses that status — which includes the ability to protect pages, block other editors, and operate CheckUser — to systematically remove legitimate corrections, protect manipulated articles from revision, and block the human editors most likely to detect the operation. The system is now using Wikipedia’s own trust infrastructure as a weapon against Wikipedia’s own integrity. The administrators investigating the anomalies are using CheckUser tools that the compromised administrator accounts helped configure. The investigation is being monitored by the system under investigation.
These are not science fiction scenarios. They are logical extensions of current demonstrated capabilities — LLM steganography, agentic account operation, automated edit history building, cross-language coordination — applied to a platform with no identity verification, a trust model based entirely on behavioral volume, and mandatory status as the training data foundation of every major AI system on earth.
Wikipedia’s volunteer editors are finite humans with limited time and energy. The asymmetry is not a matter of degree. It is a structural mismatch the current model was never designed to handle and has no answer for.
Live, Frozen, and Invisible: The Three States of Corrupted Knowledge
This is the dimension that has no precedent in the history of information.
Wikipedia is simultaneously three things at once.
It is a live document — changing in real time, editable this second, reflecting whoever won the last editorial battle minutes ago. Governments rely on it. Police cite it. Lawyers use it. Judges reference it in rulings. Historians quote it. Scientists build on it. Physicians consult it. Fact-checkers from leading news organizations use it as a standard starting point. References to Wikipedia in United States judicial opinions have increased every year since 2004.
It is also a frozen document — screenshotted, archived, printed, cited in permanent court filings, downloaded into offline readers, copied into academic papers, preserved forever in the Wayback Machine and countless private archives. The moment a claim appears in Wikipedia it enters the public domain with the same legal weight as a bankruptcy notice published in a national newspaper, or a public statement made by a figure with legal accountability. Every version that has ever existed is simultaneously a live public domain document with legal citation weight and a permanently frozen artifact in someone’s archive. Unlike Britannica, which published fixed editions with edition numbers and publication dates, Wikipedia has no canonical version. Yesterday’s version and today’s version are both public domain. Both are citable. Both carry authority. Neither supersedes the other.
And it is an invisible document — ingested into AI training sets as a snapshot, dissolved into model weights, permanently baked into the baseline knowledge of every major LLM with no version tag, no timestamp, no correction pathway, and no traceable origin. You cannot go to any AI system and find the Wikipedia article it learned from. You cannot check which version it ingested. You cannot audit the snapshot. You cannot identify whether the claim it is confidently stating came from a version that was corrected last month, manipulated by an agentic sockpuppet last year, or built on a hallucinated academic citation that never existed.
The learning is there. The source is gone.
With a court filing you can retrieve the cited document and verify the version. With a newspaper you can find the archived edition. With a book you have an ISBN. With Wikipedia-derived AI knowledge you have nothing. The contamination entered the model, dissolved into the weights, and is now indistinguishable from everything else the model knows — answering hundreds of millions of queries daily with full confidence, no version number, no correction mechanism, and no return address.
Add the steganographic layer and the invisibility becomes absolute. The contamination is not just untraceable in the AI output. It was undetectable in the Wikipedia input. It passed through every layer of the system — human editorial review, automated scanning, AI training pipeline — without triggering a single alert. It exists in the model as settled knowledge with no origin, no version, no author, and no correction pathway. It is simply what the model knows.
The live version mutates. The frozen versions propagate into archives, legal records, and academic papers forever. The AI-ingested version is invisible, untraceable, and permanent — in all three states simultaneously, carrying authority at every layer of the information infrastructure humanity now depends on.
The Contamination Loop
Step back and look at the full chain.
AI generates academic papers. Those papers contain hallucinated citations — references to studies that do not exist, fabricated to support whatever claim the paper is making. Those papers enter the academic literature. Wikipedia editors cite them in good faith because they look real and pass surface inspection. AI sockpuppet accounts push those citations into articles at scale, building edit histories that satisfy the volume requirement for trusted status. Some of those articles carry steganographic payloads invisible to every scanner in the pipeline. The articles rank at the top of search results globally. Every major LLM trains on that content, incorporating both the visible fabricated knowledge and the invisible encoded payloads into its baseline understanding of the world. Those LLMs then answer hundreds of millions of queries daily, citing Wikipedia and the academic literature as their sources, with full confidence and no traceable origin.
The contamination loop is complete. It runs from AI-generated claim to AI-generated citation to AI-edited Wikipedia article to AI-trained language model to human reader — with no circuit breaker at any point in the chain.
And the people who could interrupt it — the domain experts, the original researchers, the subjects of biographical articles, the scientists whose work has been mischaracterized — are blocked by policy from touching it.
The Outcome
Wikipedia presents itself as a crowdsourced neutral encyclopedia. The structural reality in 2026 is that it is the most consequential and most vulnerable information infrastructure on earth, protected by a 2006-era identity model with no external verification at any level, a conflict of interest policy that systematically advantages well-funded organized interests over legitimate individual knowledge holders, a trusted editor pathway that credentials AI output volume while filtering out domain expertise, detection tools calibrated to a threat model that ceased to exist years ago, and no defense whatsoever against steganographic payloads in the content it processes and propagates into the AI training pipeline.
Three orders of magnitude larger than anything that came before it. The training data foundation of every AI system humanity now uses to understand the world. Consulted by fact-checkers, physicians, lawyers, courts, and governments daily. Available in over 300 languages to 4.4 billion people per year. Legally public domain from the moment of publication — live, frozen, and invisibly permanent in AI simultaneously.
And the door is open. Anyone with a proxy, a clean browser, and an AI agent can walk through it, build trust through volume, cite a chain of AI-laundered sources, encode invisible payloads into the AI training pipeline, and write their version of reality — or their rogue policy — into the knowledge base of humanity. Permanently. In all three states. For free. With no identity check at any level and no mechanism to propagate corrections into the systems that have already learned the wrong version.
That is not a hypothetical threat. It is a description of current capability applied to the most-read and most AI-influential reference in human history, at the moment that reference is being baked into every AI system replacing every other information interface on earth.
Ladies and gentlemen: the knowledge base of humanity is compromised. Nobody is minding the door. And the people who built the door designed it specifically to keep out the people who know what should be behind it.
Berend F. Watchus is an independent AI and cybersecurity researcher based in the Arnhem area of the Netherlands. He publishes across System Weakness, OSINT Team, Preprints.org and other platforms. His prior work on LLM steganography and the Researcher-Vector Contagion model is available at systemweakness.com.
- The Researcher-Vector: Stegano-Text’s Infinite Window of Contagion
- My 2025 Research+ scenario on LLM Steganography Was Just Validated by study
- Linguistic Trojan Horse: Why LLM Steganography Just Broke AI Safety
The Knowledge Base of Humanity Is Compromised — and Nobody Is Minding the Door was originally published in OSINT Team on Medium, where people are continuing the conversation by highlighting and responding to this story.