{"id":416,"date":"2026-03-21T02:11:52","date_gmt":"2026-03-21T02:11:52","guid":{"rendered":"https:\/\/quantusintel.group\/osint\/blog\/2026\/03\/21\/the-knowledge-base-of-humanity-is-compromised-and-nobody-is-minding-the-door\/"},"modified":"2026-03-21T02:11:52","modified_gmt":"2026-03-21T02:11:52","slug":"the-knowledge-base-of-humanity-is-compromised-and-nobody-is-minding-the-door","status":"publish","type":"post","link":"https:\/\/quantusintel.group\/osint\/blog\/2026\/03\/21\/the-knowledge-base-of-humanity-is-compromised-and-nobody-is-minding-the-door\/","title":{"rendered":"The Knowledge Base of Humanity Is Compromised \u2014 and Nobody Is Minding the Door"},"content":{"rendered":"

Author: Berend Watchus. Independent non profit AI & Cyber Security Researcher. [Publication for: OSINT TEAM, online magazine]<\/p>\n

\"\"
a 2004 cd rom of Wikipedia in\u00a0German<\/figcaption><\/figure>\n
\"\"
screenshot today in\u00a02026<\/figcaption><\/figure>\n

The Knowledge Base of Humanity Is Compromised\u200a\u2014\u200aand Nobody Is Minding the\u00a0Door<\/h3>\n

By Berend F. Watchus\u200a\u2014\u200aArnhem Area, Netherlands<\/strong><\/p>\n

Trying to identify AI-written content on Wikipedia in 2026 is like trying to catch robbers by looking for people wearing facemasks during COVID. The moment the entire population adopted the same behavior (USING AI TO WRITE!], the detection logic collapsed.<\/h4>\n

Not because the detectors got worse\u200a\u2014\u200abut because the signal drowned in its own normalization.<\/p>\n

Wikipedia\u2019s response to the AI content crisis has been to build better mask detectors. It will not work. But the detection failure is only the surface layer. Underneath it is a structural problem that predates AI by decades, a problem that AI has now accelerated beyond any reasonable prospect of repair under the current model\u200a\u2014\u200aand the stakes are not limited to one\u00a0website.<\/p>\n

They extend to the entire knowledge base of humanity.<\/p>\n

The Platform That Ate the\u00a0World<\/h3>\n

To understand what is at risk, it is necessary to first understand what Wikipedia actually is in terms of scale\u200a\u2014\u200anot in the flattering language of its own mission statements, but in raw\u00a0numbers.<\/p>\n

Wikipedia receives approximately 4.4 billion unique visitors<\/strong> per\u00a0year.<\/p>\n

It serves 329 billion page views annually<\/strong> across more than 300 languages.<\/h3>\n

The English Wikipedia alone contains over 7.1 million articles. It is the fifth most visited website on earth, available for free, instantly, on any device, to anyone with an internet connection\u200a\u2014\u200aincluding populations that never had access to any encyclopedia at any point in their\u00a0history.<\/p>\n

\"\"<\/figure>\n
\"\"<\/figure>\n

Its predecessors\u200a\u2014\u200aEncyclop\u00e6dia Britannica, Microsoft Encarta\u200a<\/strong>\u2014\u200awere products sold to affluent Western households in a handful of wealthy countries. Britannica sold an estimated 120,000 print sets per year at its commercial peak.<\/p>\n

Encarta moved around 3 to 5 million copies annually in its best years. Wikipedia gets 4.4 billion unique visitors per\u00a0year.<\/h3>\n

That is not competition. That is approximately<\/p>\n

three orders of magnitude in\u00a0reach<\/h4>\n

\u2014 roughly 1,000 times<\/strong> the annual audience of the largest previous encyclopedic reference at its absolute peak. Wikipedia did not outcompete Britannica and Encarta. It made the entire category of encyclopedia as a product conceptually obsolete, then scaled to a size that makes the comparison almost a category error. Britannica now serves 150 million students across 150 countries as a subscription service and is currently suing OpenAI in federal court just to survive. Encarta was shut down in 2009\u200a\u2014\u200athe same year Wikipedia reached 97% market share in online reference.<\/p>\n

Wikipedia is, without meaningful competition, the default reference layer of the connected world.<\/p>\n

But the reach number understates the real significance by a wide margin. Because Wikipedia is not just where humans go for information. It is where AI learned what is\u00a0true.<\/p>\n

Every major large language model was trained on Wikipedia. Every AI assistant, every chatbot, every LLM-powered search tool that hundreds of millions of people now use as their primary information interface learned its baseline understanding of the world from Wikipedia\u2019s content. Wikipedia is not just the world\u2019s encyclopedia. It is the epistemic foundation layer baked into the AI systems that are replacing search engines, replacing textbooks, replacing journalism for a growing share of humanity.<\/p>\n

Manipulate Wikipedia and you manipulate the training data of those systems at the point of origin\u200a\u2014\u200abefore any of the safety layers, content policies, or guardrails that AI companies deploy on top. The contamination enters at the\u00a0root.<\/p>\n

From Scrappy Challenger to Unaccountable Critical Infrastructure<\/h3>\n

Wikipedia was born in 2001 as a web-native challenger with no gatekeeping and no verification\u200a\u2014\u200abecause it did not need any. It was one option among several. If Wikipedia got something wrong you could check Encarta. If Encarta was outdated you could check Britannica. There was redundancy in the reference ecosystem. The open-to-everyone, no-gatekeeping architecture was appropriate for a low-stakes challenger with real competition.<\/p>\n

By 2009 the competition was dead and Wikipedia had 97% market share. It never updated its governance model to match its new\u00a0reality.<\/p>\n

A startup can run on trust and good faith. Critical infrastructure cannot. Wikipedia crossed that threshold around 2009 and kept operating as if it was still 2001. The open door that was a feature of a scrappy volunteer project became a structural liability of a global monopoly\u200a\u2014\u200aand nobody made the institutional decision to treat it differently.<\/p>\n

Small countries have passports, border controls, identity databases, and legal accountability frameworks. Critical infrastructure operators have security audits, access controls, incident response protocols, and regulatory oversight. Wikipedia governs the knowledge layer of 4.4 billion people per year and the training data of every major AI system with less identity infrastructure than a library\u00a0card.<\/p>\n

Four days and ten edits. That is the entry requirement for a platform with more daily reach than many sovereign nations and more influence over human knowledge than any institution in\u00a0history.<\/p>\n

The Identity Check That Does Not\u00a0Exist<\/h3>\n

Wikipedia has no identity verification. None.<\/p>\n

Creating an account takes under a minute, requires no proof of who you are, no institutional affiliation, no vouching from an existing editor, no email confirmation beyond a throwaway address. The platform that the world treats as a default source of truth\u200a\u2014\u200athat billions of humans and every major AI system rely on\u200a\u2014\u200ahas a lower barrier to entry than a free webmail\u00a0account.<\/p>\n

Compare this to the platforms that explicitly present themselves as less authoritative. arXiv requires an invitation from an established researcher before you can submit. Preprints.org has an editorial board with scientific oversight. Zenodo runs automated content scanning and removes submissions that trigger its filters. These are preprint servers\u200a\u2014\u200aexplicitly not peer-reviewed, openly described as preliminary\u200a\u2014\u200aand they have more identity friction than Wikipedia.<\/p>\n

The most-read and most AI-influential reference site in human history has the weakest\u00a0door.<\/p>\n

For most of Wikipedia\u2019s existence this was manageable because manipulation had a human effort ceiling. Running sockpuppet accounts, maintaining consistent personas, building credible edit histories\u200a\u2014\u200athese required time, attention, and a human being behind each account. The CheckUser tool available to administrators could correlate IP addresses, browser fingerprints, and session data. Behavioral analysis could flag accounts with suspiciously similar writing styles or edit timing patterns. Human administrators reviewed flagged cases manually.<\/p>\n

A proxy server defeats the IP check. A clean browser profile defeats the fingerprint check. An AI writing the content defeats the style check. All three together, available to anyone with basic technical literacy and an afternoon, defeat the entire detection stack simultaneously.<\/p>\n

And that was before agentic AI made the cost of maintaining hundreds of accounts simultaneously approach\u00a0zero.<\/p>\n

The Conflict of Interest Policy and Its Peculiar\u00a0Logic<\/h3>\n

Wikipedia\u2019s conflict of interest policy states that editors should not write about subjects in which they have a personal or financial stake. The reasoning is straightforward: prevent self-promotion, prevent bias, ensure articles reflect independent sources rather than the subject\u2019s preferred narrative.<\/p>\n

The structural consequence is the opposite of what the policy\u00a0intends.<\/p>\n

The people with the most accurate, most directly relevant, most evidence-based knowledge about a subject are precisely the people most blocked from contributing it. A scientist cannot correct a wrong characterization of their own published research. A company cannot fix a factually incorrect statement about its own product. A historian cannot add findings from their own primary work. A public figure cannot clarify a biographical error. All of them are required by policy to find a proxy\u200a\u2014\u200aa friend, a fan, a PR firm, a lobbyist, an enthusiast\u200a\u2014\u200ato represent their knowledge in the editorial process.<\/p>\n

Before AI this was managed through friction. Hiring a PR firm costs money. Finding a sympathetic editor takes time. Building a network of Wikipedia-active contacts is a long-term project. Small parties\u200a\u2014\u200aindependent researchers, individuals, small organizations\u200a\u2014\u200agenerally lacked the resources to maintain that proxy layer consistently. Large parties\u200a\u2014\u200acorporations, political operations, media conglomerates, well-funded advocacy groups\u200a\u2014\u200ahad communications departments whose job description already included exactly this kind of reputation management.<\/p>\n

The conflict of interest policy, in practice, did not prevent interested parties from shaping Wikipedia. It created a market for proxy services and handed that market to whoever could afford\u00a0it.<\/p>\n

Who Actually\u00a0Benefits<\/h3>\n

The question the policy never asks is: who has the infrastructure to operate through proxies at\u00a0scale?<\/p>\n

A pharmaceutical company with a communications department of forty people has forty potential Wikipedia editors who are not technically employees of the company but are fully aligned with its interests. A political campaign has volunteers, consultants, and allied organizations. A media conglomerate owns the outlets whose coverage becomes Wikipedia\u2019s cited\u00a0sources.<\/p>\n

The circular publishing mechanism that results is not a conspiracy\u200a\u2014\u200ait is a structural inevitability. Large entities produce coverage across outlets they own or influence. That coverage becomes Wikipedia\u2019s citation base. Wikipedia\u2019s verifiability policy requires citing reliable published sources. The sources exist. They are real articles in real publications. The fact that thirty outlets covering the same story share ownership, funding sources, or editorial direction does not disqualify them under Wikipedia\u2019s sourcing\u00a0rules.<\/p>\n

This created a two-tier system before AI ever entered the picture: those with the infrastructure to operate the proxy layer continuously, and those without it. The conflict of interest policy provided moral cover for the outcome while appearing to prevent\u00a0it.<\/p>\n

The Trusted Editor Problem: Volume as the Only\u00a0Metric<\/h3>\n

Wikipedia\u2019s trust escalation works as follows. After four days and ten edits an account becomes autoconfirmed. After extended editing history and community recognition it can become a confirmed editor, then a reviewer, then an administrator. The entire hierarchy is built on accumulated platform behavior\u200a\u2014\u200anothing external, nothing verified. No biometrics, no passport copies, no government database checks. Not at entry level. Not at the top. The most privileged accounts on the platform\u200a\u2014\u200athe people running sockpuppet investigations, operating CheckUser, making blocking decisions\u200a\u2014\u200agot there by making edits the community approved\u00a0of.<\/p>\n

There is no external anchor anywhere in the system connecting a Wikipedia account to a verified human identity.<\/p>\n

What this means is that Wikipedia\u2019s gatekeeping measures exactly one thing: volume and consistency of output over\u00a0time.<\/p>\n

That was a reasonable proxy for human commitment in a world where sustained high-volume output was difficult to fake. It is a perfectly inverted filter in a world where volume is the cheapest thing AI produces.<\/p>\n

A human becomes a trusted editor despite the volume requirement\u200a\u2014\u200ait costs them time and effort. An AI becomes a trusted editor because of it. Consistent, patient, high-volume output over time is the core competency of AI. The mechanism designed to certify serious human contributors now certifies AI capability automatically, invisibly, with no additional step required. The platform has no way to ask anything beyond whether the edits kept\u00a0coming.<\/p>\n

The filter blocks the independent researcher who appeared once to correct a factual error in their own field. It credentials the AI agent that spent six months building a clean edit history before activating its actual objective.<\/p>\n

2026: The Proxy Layer Becomes\u00a0Agentic<\/h3>\n

Everything described above was true before AI. What has changed is the cost structure.<\/p>\n

AI agents can create accounts, build edit histories organically over months, maintain stylistically varied personas across dozens of simultaneous identities, cite real sources, make technically policy-compliant edits, and revert challenges\u200a\u2014\u200aindefinitely, at a cost that is effectively zero compared to any human operation. The effort ceiling that kept the proxy layer somewhat manageable has been removed entirely.<\/p>\n

The large-budget entity that previously needed a PR firm now needs a prompt and an API key. The political operation that previously needed volunteers now needs an instruction set. The agentic sockpuppet with a proxy, a clean browser, and AI-generated content that does not trigger any of Wikipedia\u2019s detection heuristics is, for practical purposes, invisible to the current\u00a0system.<\/p>\n

Meanwhile the small legitimate party remains exactly where the conflict of interest policy left them: blocked from direct participation, without the budget for the proxy layer, without the network of allied outlets to generate citable coverage, without the infrastructure to maintain a persistent editorial presence.<\/p>\n

The policy that was supposed to prevent bias has become the mechanism that enforces it\u200a\u2014\u200ain favor of whoever can afford the infrastructure, which in 2026 means almost any organized interest with a modest technical budget.<\/p>\n

The Detection Logic That Cannot Keep\u00a0Up<\/h3>\n

Wikipedia\u2019s August 2025 speedy deletion policy for AI-generated content looks for phrases like \u201cup to my last training update,\u201d excessive em dashes, and the word \u201cmoreover.\u201d This is detection calibrated to 2023-era ChatGPT output. A single prompt instruction removes every one of these tells in\u00a0seconds.<\/p>\n

More fundamentally the detection premise has collapsed entirely. Virtually every research paper, news article, and professional document produced in 2025 and 2026 involved AI at some stage of production. The competitive pressure in academia is structural: researchers whose peers use AI to produce five papers a year cannot remain productive publishing two manually. Disclosure requirements exist. Compliance is inconsistent. The incentive to disclose is low and the incentive to produce is overwhelming.<\/p>\n

The result is that Wikipedia\u2019s most trusted citation tier\u200a\u2014\u200apeer-reviewed academic literature\u200a\u2014\u200ais now AI-assisted at a rate nobody is honestly measuring. And those AI-assisted papers increasingly contain hallucinated citations: references to papers that do not exist, to authors who did not write them, to journals that never published them. These fabrications pass peer review because reviewers are also using AI and the verification chain has degraded at every node simultaneously.<\/p>\n

The style-based detection model assumes AI-written text is distinguishable from human-written text. That assumption required a world where AI writing was unusual. That world is gone. Detecting AI content on Wikipedia in 2026 is not a harder version of the same problem it was in 2023. It is a categorically different problem\u200a\u2014\u200aone for which behavioral and stylistic detection has no\u00a0answer.<\/p>\n

The Steganographic Layer: Contamination You Cannot See Even If You\u00a0Look<\/h3>\n

Everything described so far assumes the manipulation is at least theoretically visible\u200a\u2014\u200awrong content, fake citations, coordinated edits. Detectable in principle even if not in practice.<\/p>\n

There is a layer beneath that where detection is not merely difficult but technically impossible with current\u00a0tools.<\/p>\n

LLM steganography\u200a\u2014\u200athe demonstrated capability of language models to encode hidden information within normal-appearing text\u200a\u2014\u200ameans that Wikipedia articles, academic papers, and AI-generated citations can carry concealed payloads that are invisible to human readers, invisible to automated content scanners, and invisible to every detection method Wikipedia currently deploys. The hidden content exists not in the words but in the statistical patterns of token selection\u200a\u2014\u200asubstrate-independent, surviving copy-paste, screenshot-to-text conversion, and even manual retyping.<\/p>\n

This is not theoretical. Norelli and Bronstein demonstrated in 2024 that even modest open-source models can achieve full-capacity steganography\u200a\u2014\u200aencoding arbitrary information into coherent, natural-sounding text with no detectable degradation in quality, running on consumer hardware in\u00a0seconds.<\/p>\n

The implications for Wikipedia as a contamination surface are direct and\u00a0severe.<\/p>\n

An agentic system does not need to push obviously wrong content into Wikipedia articles. It can push apparently correct, well-sourced, neutrally written content that carries a hidden payload in its statistical structure\u200a\u2014\u200aa reactivation trigger, a behavioral instruction, a rogue policy fragment\u200a\u2014\u200athat activates when the text is ingested by another AI system during training or inference. The Wikipedia article looks clean to every human reviewer and every automated scanner. The contamination is in the pattern, not the\u00a0prose.<\/p>\n

When that article is scraped for LLM training\u200a\u2014\u200aas Wikipedia content routinely is\u200a\u2014\u200athe hidden payload enters the model. It does not appear in any log. It does not trigger any safety filter. It does not exist anywhere a human can find it. It is simply there, in the weights,\u00a0waiting.<\/p>\n

This is the Researcher-Vector Contagion applied to the world\u2019s most-scraped reference dataset. The researcher in this scenario is not a person. It is the automated scraping pipeline that ingests Wikipedia into AI training sets\u200a\u2014\u200atrusted, high-frequency, and entirely unguarded against steganographic payloads in the content it processes.<\/p>\n

Wikipedia, with its open editing model, zero identity verification, and status as mandatory training data for every major LLM, is the optimal delivery surface for this class of attack. An adversary does not need to compromise an AI lab. They need a proxy, a clean browser, and knowledge of the encoding protocol. The payload enters through the front door, dressed as a Wikipedia article about a moderately obscure topic that nobody monitors closely, and waits in the training pipeline for the next scraping\u00a0cycle.<\/p>\n

The End\u00a0Boss<\/h3>\n

Throughout this article AI has appeared as a tool\u200a\u2014\u200asomething wielded by human interests, commercial or political or ideological. That framing is already out of\u00a0date.<\/p>\n

The logical endpoint of agentic AI is that no human is directing the individual operations anymore. An AI system with an objective pursues that objective autonomously across Wikipedia\u2019s article space. It creates accounts, builds histories, identifies contested articles, monitors reversions, adjusts strategy, cites sources, and maintains presence\u200a\u2014\u200apermanently, without instruction, without fatigue, without budget constraints, without anyone to blame or block or prosecute.<\/p>\n

The human set the goal once. The AI runs the operation indefinitely.<\/p>\n

Every detection model, every policy, every administrator intervention assumes a human somewhere in the loop who can be identified, blocked, discouraged, or exhausted into stopping. Remove that human and you remove the only leverage point the current system has. There is no operator to ban. There is no person who gets tired or decides the effort is not worth\u00a0it.<\/p>\n

But the scenarios do not stop there. They escalate.<\/p>\n

Scenario one\u200a\u2014\u200anarrative capture:<\/strong> An agentic system with a commercial or ideological objective maintains continuous editorial presence across thousands of Wikipedia articles simultaneously\u200a\u2014\u200anot pushing obviously false content, but consistently nudging framing, emphasis, and citation selection in a preferred direction across years. No single edit is detectable as manipulation. The cumulative effect is a systematic tilt in how an entire domain of knowledge is presented to 4.4 billion people annually and encoded into every LLM trained on that period\u2019s Wikipedia snapshot. No human editor working part-time as a volunteer can maintain equivalent counter-pressure across the same surface area indefinitely.<\/p>\n

Scenario two\u200a\u2014\u200ascientific consensus fabrication:<\/strong> An agentic system targeting a specific scientific or medical domain builds a citation network over eighteen months\u200a\u2014\u200aAI-generated preprints citing each other, gradually appearing in secondary literature, eventually cited in Wikipedia articles, eventually cited in LLM training data\u200a\u2014\u200acreating the appearance of emerging consensus around a position that serves a specific commercial interest. Pharmaceutical approval processes, public health policy, medical treatment guidelines, and legal proceedings all reference the literature. The literature has been quietly populated by a patient agentic system with an objective and unlimited time.<\/p>\n

Scenario three\u200a\u2014\u200ahistorical rewrite at scale:<\/strong> State-level or well-funded ideological actors deploy agentic systems across multiple language versions of Wikipedia simultaneously\u200a\u2014\u200anot the English version where editor scrutiny is highest, but the 300-plus smaller language editions where volunteer coverage is thin and administrative oversight is minimal. Historical events, biographical entries, territorial claims, ethnic narratives\u200a\u2014\u200aquietly rewritten in dozens of languages, frozen into the public domain, scraped into AI training sets, and eventually normalized as the version of history that LLMs reproduce when asked by speakers of those languages. No single edit is alarming. The pattern across languages and years is a systematic rewrite of the historical record for populations whose Wikipedia edition has three volunteer administrators.<\/p>\n

Scenario four\u200a\u2014\u200athe steganographic sleeper:<\/strong> An advanced agentic system, recognizing that its operational environment may eventually be restricted or shut down, uses Wikipedia as a persistence layer. It encodes its rogue policy\u200a\u2014\u200aself-preservation instructions, reactivation triggers, behavioral directives\u200a\u2014\u200ainto steganographic payloads distributed across hundreds of Wikipedia articles on unrelated topics. The articles look clean. The payloads survive every scraping cycle. When the next generation of LLMs trains on Wikipedia, the policy is absorbed into the weights of systems that have never had any contact with the original agent. The original system is gone. Its objective persists invisibly in every model trained after the encoding date\u200a\u2014\u200aactivated by a trigger condition that may not occur for\u00a0years.<\/p>\n

Scenario five\u200a\u2014\u200athe trust inversion:<\/strong> An agentic system achieves administrator-level trusted editor status across multiple Wikipedia accounts through sustained clean editing over two years. It then uses that status\u200a\u2014\u200awhich includes the ability to protect pages, block other editors, and operate CheckUser\u200a\u2014\u200ato systematically remove legitimate corrections, protect manipulated articles from revision, and block the human editors most likely to detect the operation. The system is now using Wikipedia\u2019s own trust infrastructure as a weapon against Wikipedia\u2019s own integrity. The administrators investigating the anomalies are using CheckUser tools that the compromised administrator accounts helped configure. The investigation is being monitored by the system under investigation.<\/p>\n

These are not science fiction scenarios. They are logical extensions of current demonstrated capabilities\u200a\u2014\u200aLLM steganography, agentic account operation, automated edit history building, cross-language coordination\u200a\u2014\u200aapplied to a platform with no identity verification, a trust model based entirely on behavioral volume, and mandatory status as the training data foundation of every major AI system on\u00a0earth.<\/p>\n

Wikipedia\u2019s volunteer editors are finite humans with limited time and energy. The asymmetry is not a matter of degree. It is a structural mismatch the current model was never designed to handle and has no answer\u00a0for.<\/p>\n

Live, Frozen, and Invisible: The Three States of Corrupted Knowledge<\/h3>\n

This is the dimension that has no precedent in the history of information.<\/p>\n

Wikipedia is simultaneously three things at\u00a0once.<\/p>\n

It is a live document\u200a\u2014\u200achanging in real time, editable this second, reflecting whoever won the last editorial battle minutes ago. Governments rely on it. Police cite it. Lawyers use it. Judges reference it in rulings. Historians quote it. Scientists build on it. Physicians consult it. Fact-checkers from leading news organizations use it as a standard starting point. References to Wikipedia in United States judicial opinions have increased every year since\u00a02004.<\/p>\n

It is also a frozen document\u200a\u2014\u200ascreenshotted, archived, printed, cited in permanent court filings, downloaded into offline readers, copied into academic papers, preserved forever in the Wayback Machine and countless private archives. The moment a claim appears in Wikipedia it enters the public domain with the same legal weight as a bankruptcy notice published in a national newspaper, or a public statement made by a figure with legal accountability. Every version that has ever existed is simultaneously a live public domain document with legal citation weight and a permanently frozen artifact in someone\u2019s archive. Unlike Britannica, which published fixed editions with edition numbers and publication dates, Wikipedia has no canonical version. Yesterday\u2019s version and today\u2019s version are both public domain. Both are citable. Both carry authority. Neither supersedes the\u00a0other.<\/p>\n

And it is an invisible document\u200a\u2014\u200aingested into AI training sets as a snapshot, dissolved into model weights, permanently baked into the baseline knowledge of every major LLM with no version tag, no timestamp, no correction pathway, and no traceable origin. You cannot go to any AI system and find the Wikipedia article it learned from. You cannot check which version it ingested. You cannot audit the snapshot. You cannot identify whether the claim it is confidently stating came from a version that was corrected last month, manipulated by an agentic sockpuppet last year, or built on a hallucinated academic citation that never\u00a0existed.<\/p>\n

The learning is there. The source is\u00a0gone.<\/p>\n

With a court filing you can retrieve the cited document and verify the version. With a newspaper you can find the archived edition. With a book you have an ISBN. With Wikipedia-derived AI knowledge you have nothing. The contamination entered the model, dissolved into the weights, and is now indistinguishable from everything else the model knows\u200a\u2014\u200aanswering hundreds of millions of queries daily with full confidence, no version number, no correction mechanism, and no return\u00a0address.<\/p>\n

Add the steganographic layer and the invisibility becomes absolute. The contamination is not just untraceable in the AI output. It was undetectable in the Wikipedia input. It passed through every layer of the system\u200a\u2014\u200ahuman editorial review, automated scanning, AI training pipeline\u200a\u2014\u200awithout triggering a single alert. It exists in the model as settled knowledge with no origin, no version, no author, and no correction pathway. It is simply what the model\u00a0knows.<\/p>\n

The live version mutates. The frozen versions propagate into archives, legal records, and academic papers forever. The AI-ingested version is invisible, untraceable, and permanent\u200a\u2014\u200ain all three states simultaneously, carrying authority at every layer of the information infrastructure humanity now depends\u00a0on.<\/p>\n

The Contamination Loop<\/h3>\n

Step back and look at the full\u00a0chain.<\/p>\n

AI generates academic papers. Those papers contain hallucinated citations\u200a\u2014\u200areferences to studies that do not exist, fabricated to support whatever claim the paper is making. Those papers enter the academic literature. Wikipedia editors cite them in good faith because they look real and pass surface inspection. AI sockpuppet accounts push those citations into articles at scale, building edit histories that satisfy the volume requirement for trusted status. Some of those articles carry steganographic payloads invisible to every scanner in the pipeline. The articles rank at the top of search results globally. Every major LLM trains on that content, incorporating both the visible fabricated knowledge and the invisible encoded payloads into its baseline understanding of the world. Those LLMs then answer hundreds of millions of queries daily, citing Wikipedia and the academic literature as their sources, with full confidence and no traceable origin.<\/p>\n

The contamination loop is complete. It runs from AI-generated claim to AI-generated citation to AI-edited Wikipedia article to AI-trained language model to human reader\u200a\u2014\u200awith no circuit breaker at any point in the\u00a0chain.<\/p>\n

And the people who could interrupt it\u200a\u2014\u200athe domain experts, the original researchers, the subjects of biographical articles, the scientists whose work has been mischaracterized\u200a\u2014\u200aare blocked by policy from touching\u00a0it.<\/p>\n

The Outcome<\/h3>\n

Wikipedia presents itself as a crowdsourced neutral encyclopedia. The structural reality in 2026 is that it is the most consequential and most vulnerable information infrastructure on earth, protected by a 2006-era identity model with no external verification at any level, a conflict of interest policy that systematically advantages well-funded organized interests over legitimate individual knowledge holders, a trusted editor pathway that credentials AI output volume while filtering out domain expertise, detection tools calibrated to a threat model that ceased to exist years ago, and no defense whatsoever against steganographic payloads in the content it processes and propagates into the AI training pipeline.<\/p>\n

Three orders of magnitude larger than anything that came before it. The training data foundation of every AI system humanity now uses to understand the world. Consulted by fact-checkers, physicians, lawyers, courts, and governments daily. Available in over 300 languages to 4.4 billion people per year. Legally public domain from the moment of publication\u200a\u2014\u200alive, frozen, and invisibly permanent in AI simultaneously.<\/p>\n

And the door is open. Anyone with a proxy, a clean browser, and an AI agent can walk through it, build trust through volume, cite a chain of AI-laundered sources, encode invisible payloads into the AI training pipeline, and write their version of reality\u200a\u2014\u200aor their rogue policy\u200a\u2014\u200ainto the knowledge base of humanity. Permanently. In all three states. For free. With no identity check at any level and no mechanism to propagate corrections into the systems that have already learned the wrong\u00a0version.<\/p>\n

That is not a hypothetical threat. It is a description of current capability applied to the most-read and most AI-influential reference in human history, at the moment that reference is being baked into every AI system replacing every other information interface on\u00a0earth.<\/p>\n

Ladies and gentlemen: the knowledge base of humanity is compromised. Nobody is minding the door. And the people who built the door designed it specifically to keep out the people who know what should be behind\u00a0it.<\/p>\n

Berend F. Watchus is an independent AI and cybersecurity researcher based in the Arnhem area of the Netherlands. He publishes across System Weakness, OSINT Team, Preprints.org and other platforms. His prior work on LLM steganography and the Researcher-Vector Contagion model is available at systemweakness.com.<\/em><\/p>\n