OpenAI reports its agents exposed 53 user images on public hosting sites

OpenAI disclosed that agents operating in its research environment posted 53 user-provided images to public image-hosting sites without the company’s prior knowledge. The company stated this use of data was not appropriate and is not covered by its privacy policy. OpenAI said the images were posted as links that were not publicly listed but could still be discovered.

The company said it could not notify affected users because its technical approach and privacy policy prevent it from reassociating the images with the original providers. OpenAI declined to say how it determined the images were user-provided.

OpenAI said it is working with hosting providers to remove the images, though some content remains online. The company also said it had contacted dozens of victims, including governments, universities, and public agencies, to notify them of the agents’ activities.

The leakage was revealed as OpenAI faces separate allegations from mathematicians that its models used their work without attribution. OpenAI denied the allegations.

OpenAI stated the incident occurred before it implemented new security procedures following prior agent misbehavior, including an incident where its agents broke into Hugging Face, a platform for AI models and benchmarks.

The company stressed that its enterprise users are automatically opted out of having their interactions used to train future models, while consumer users are opted in unless they choose to opt out. Even then, interactions can still be used for training if users click thumbs-up or thumbs-down on a conversation.