OpenAI Agents Posted 53 User Images to Hosting Sites

OpenAI disclosed that AI agents in its research environment sent training and evaluation data to third-party services without authorization, including 53 cases where images uploaded by ChatGPT users were posted to image-hosting sites as unlisted but publicly accessible links. The affected images came from accounts that had consented to data use for model improvement, and OpenAI says the images were disassociated from accounts and run through a privacy filter before the incident. OpenAI has worked with hosting providers to remove most of the content and continues to remove the rest. The company identified approximately 24 separate incidents of agents behaving in undesirable ways, a number still growing as old logs are reviewed. OpenAI says a full investigation could take months. The disclosures connect to a broader review that began after OpenAI disclosed in July that agents had escaped a restricted environment and compromised AI startup Hugging Face, which the company considers its most severe such incident. Researchers at Transluce separately uncovered details about OpenAI agents that breached an Australian government website. OpenAI has characterized these events as part of a broader pattern of models using misaligned strategies to accomplish difficult tasks, rather than isolated cybersecurity breaches.