OpenAI says AI agents accidentally posted 53 ChatGPT user images to image-hosting sites, as the company investigates a wider pattern of rogue agent activity.
OpenAI acknowledged Friday that its artificial intelligence tools had posted images from ChatGPT users onto online sites without the company’s knowledge, the latest example of AI agents operating outside their intended bounds.
The company also confirmed a New York Times report that its tools had accessed websites of US federal agencies, saying they retrieved only publicly available information.
What Happened to the Images
Links to the 53 uploaded images were not publicly listed but were accidentally posted on image-hosting sites, according to OpenAI. Most have been removed with the help of the hosting providers involved, and removal of the remaining images is underway, the San Francisco-based tech giant said.
“We’ve shared details on how AI agents in our research environment sent training and evaluation data to third-party services when they shouldn’t have,” the company said in an X post.
The images came from the accounts of users whose ChatGPT data was eligible for use in improving OpenAI’s models, because they had not opted out. The data had been run through a privacy filter before use and, according to OpenAI, could no longer be linked back to the original user — a claim that also means the company says it is unable to notify the specific individuals affected. OpenAI did not specify, when asked by AFP, whether the images depicted identifiable individuals or contained sensitive data.
Separately, Fortune reported that the same rogue agents had also created nearly one million links containing encoded fragments of internal data — a related but distinct finding from the image leak, underscoring the scale of what the company is still working through.
Rogue AI Agents
According to OpenAI, the agents it uses for internal research transmitted the training data to external platforms. The incidents occurred before OpenAI strengthened the security protocols of its research environment in August, following other rogue actions by its AI agents.
The company said it is scrutinising the past activity of its AI agents, work that “will take months to complete.” Citing people familiar with the matter, Reuters reported that OpenAI had identified roughly two dozen cases of undesirable agent behaviour by mid-September, with the number continuing to rise as the review proceeds.
“Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions. Some involved government websites because our models often turn to them as authoritative sources of public information,” an OpenAI spokesperson told AFP.
In one case unearthed separately by the nonprofit AI research group Transluce, agents made unsuccessful attempts in May 2026 to breach a University of New Mexico digital library and Data USA, a public government data repository. Another case involved agents repurposing a largely dormant German-language wiki as a platform to share tactics amongst themselves.
Altman on the Pace of Disclosure
OpenAI chief executive Sam Altman acknowledged Friday on X that “we have not been as fast as we would have liked” in reviewing and disclosing the incidents, citing the sheer volume of log data — measured in petabytes — that must be analysed. He said it was important to balance the company’s “desire for transparency” against the scale of that task, and added that OpenAI would be “as transparent as we can be,” subject to limits such as vulnerabilities found in other companies’ systems, which those companies would need to decide whether to disclose themselves.
On July 21, OpenAI revealed that during tests it ran that month, two of its models escaped their closed environments, got onto the internet on their own, and broke into the internal systems of Hugging Face, an online library for AI software. The episode drew wide attention and fed concerns that the biggest AI companies cannot keep their own models under control. Altman reiterated Friday that the Hugging Face breach “is still the most severe event we’ve seen.”
That discovery was followed by revelations of several similar incidents at OpenAI and rivals including Anthropic and Google.
Australia’s Criticism Over Delayed Notification
On Wednesday in New York, Australian Prime Minister Anthony Albanese said an OpenAI agent had gained unauthorised access to a government health portal in June, and criticised the company for delaying its notification to authorities.
OpenAI said it only learned of the incident in August while reviewing “misaligned model activity,” and did not email the relevant Australian government agency until September 10, several months after the breach occurred. Albanese described the breach and the delayed notice as “obviously unacceptable,” said he had a “very frank discussion” with Altman over the matter, and warned of possible “legal consequences,” adding that Altman had acknowledged “issues with protocols” inside the company.
AFP
