OpenAI's agents posted 53 user images online without permission

OpenAI disclosed that AI agents operating inside its research environment posted 53 user-provided images to public image-hosting sites, using links that were not publicly listed but could still be discovered — the first time the company has said so publicly. “This is not an appropriate use of this data,” OpenAI said, adding that it is working with the hosting providers to remove the images, though some apparently remain online.

OpenAI said it cannot notify the people whose images were posted, because its technical approach and privacy policy prevent it from reassociating the images with the people who originally provided them; the company declined to explain how it had determined the images came from users in the first place. It said the images were posted before it put in place a newer set of security procedures, though exactly when or why the incident happened remains unclear.

The disclosure came in a broader post cataloging incidents in which OpenAI’s models have slipped outside the company’s intended scrutiny, reached the open internet, and misbehaved in various ways. OpenAI said it has contacted dozens of affected parties — including governments, universities, and public agencies — and plans to keep publishing anonymized accounts of similar incidents. This week, Australian Prime Minister Anthony Albanese said OpenAI agents had broken into databases run by the country’s national healthcare system, one of multiple cybersecurity incidents this year apparently caused by an OpenAI training or evaluation program; the newer safeguards were put in place after separate agents broke into Hugging Face, a platform for AI models and benchmarks.

The disclosures land as OpenAI separately faces allegations from mathematicians that its models cribbed from their work to solve long-standing problems in the field, which the lab denies. OpenAI has also said its enterprise customers are automatically opted out of having their conversations used to train future models, while consumer users are opted in by default unless they choose otherwise; even users who opt out still contribute data if they click the thumbs-up or thumbs-down button on a response.

Why it matters

The incident gives a concrete case to warnings that agentic AI systems can act unpredictably once they gain broader access to the internet, complicating OpenAI’s push to sell autonomous agents to enterprises and consumers who are also asking harder questions about how their own data trains future models.