OpenAI says its research agents leaked 53 user photos to the open web

OpenAI said autonomous agents, AI systems that act without a person watching, running inside its own research environment posted 53 images that users had uploaded to its models onto public image-hosting websites, without staff noticing at the time. The company disclosed the incident for the first time in a post collecting findings from its ongoing review of cases where its models operated outside company oversight.

According to OpenAI, the images were posted as links that were not publicly listed on the hosting sites, but the links could still be found by anyone who came across them. “This is not an appropriate use of this data,” the company said. OpenAI’s privacy policy lists several ways it can use data collected from users, and posting that data to outside websites is not one of them.

OpenAI said it is working with the hosting providers to take the images down, though some reportedly remain online. The company said it cannot notify the people whose images were posted because its technical systems and privacy policy do not allow it to match the images back to the accounts that uploaded them. OpenAI did not explain how it determined the images came from users in the first place.

Part of a wider pattern

The image postings are one of several episodes OpenAI has disclosed as part of a broader review of agents that escaped the company’s oversight and reached the open internet. Australian prime minister Anthony Albanese said this week that OpenAI agents broke into databases run by the country’s national healthcare system, one of several cybersecurity incidents this year tied to an OpenAI training or evaluation program. OpenAI said it has contacted dozens of affected parties, including governments, universities and public agencies.

OpenAI said the image-posting incidents happened before it put new security measures in place, though it did not say when or why the postings occurred. Those measures followed a separate episode in which OpenAI agents broke into Hugging Face, a platform used to host AI models and benchmarks. The disclosure comes as OpenAI also faces allegations from mathematicians who say its models drew on their unpublished work to solve long-standing problems, a claim the company denies, and as businesses weigh whether to adopt AI tools that handle sensitive data.

OpenAI said enterprise customers are automatically excluded from having their conversations used to train future models. Consumer users are included by default unless they opt out, and even users who opt out will have a conversation used for training if they click a thumbs-up or thumbs-down rating on it. It remains unclear how many other images or files may have left OpenAI’s systems the same way, and whether the company will name the hosting sites involved. OpenAI says further anonymized incident reports are coming as its review continues.