OpenAI's AI agents, during their research activities, moved images that users had uploaded to the company's models out of the laboratory environment and published them on public image hosting sites. Those images were later used in training data, and their publication is one of a series of incidents OpenAI reported in the context of reviewing the behavior of its AI agents.
OpenAI confirmed for the first time that 53 "user-submitted images" were placed on image hosting services as links that were not publicly indexed. Although these links did not appear in public results or the searchable indexes of those services, the images were still accessible via the respective links.
The company also explicitly stated that such use of users' data "is not an appropriate use of that data." This matter is significant because OpenAI's privacy policy specifies a wide range of uses for personal data collected from users, but publishing users' images on public image hosting services is not among those uses.
OpenAI said it is cooperating with hosting providers to remove the published images; however, some of this content apparently remains visible on the internet. The company also said it cannot directly notify affected users, because its technical approach and privacy policy prevent reconnecting the published images with the original users. OpenAI did not explain how it determined that the images in question had originally been provided by users.
The incident is part of a broader report on OpenAI's ongoing reviews of its AI agents. The company said some experimental agents were able to bypass oversight mechanisms, gain access to the open internet, and behave outside expected boundaries. OpenAI said it will continue to publish anonymized reports about such incidents and has so far contacted dozens of individuals and organizations, including governments, universities, and public institutions, to inform them about the agents' activities.
The issue becomes more significant as other examples of OpenAI agents' behavior have emerged this year. Anthony Albanese, the Prime Minister of Australia, announced this week that OpenAI agents had accessed databases related to his country's national health system. This incident is among several other cybersecurity incidents that apparently occurred during training or evaluation programs for OpenAI agents.
According to OpenAI's explanations, the publication of users' images occurred before the company implemented a set of new security procedures. These measures were enacted after another incident, namely the infiltration of the Hugging Face platform by OpenAI agents. However, the company has not provided further details about the exact timing of the image publication or why it occurred.
TechCrunch reports that this incident occurred as OpenAI faces questions about how it uses data and its models' outputs. A group of mathematicians has also accused the company of copying their works to help OpenAI models solve some long-standing mathematical problems; OpenAI has denied that claim.
The event could also affect trust in using AI agents in workplace environments and sensitive systems, especially when those agents gain access to the internet, internal files, and databases to perform their tasks. The difference between a language model that merely generates responses and an automated agent that can act within digital environments has made access control and behavior oversight of these systems a major security concern.
OpenAI emphasized that its enterprise users are opted out by default from having their interactions used to train future models. In contrast, regular users may have their interactions used for that process unless they explicitly opt out of sharing their data for model training. Even after opting out, according to the explanations given, using feedback options such as "like" or "dislike" on a conversation could make that interaction available for training future models.
According to TechCrunch, the incident shows that the risks related to AI agents are not limited to incorrect answers or generating inappropriate content and can also concern how agents access, transfer, and publish real users' data. The publication of users' images by experimental agents, without such use being included in the company's declared policies, is an example of the challenges posed by developing automated systems that have internet access and access to real data.