OpenAI Discloses Agents Shared User Images and Accessed Government Websites

OpenAI said Friday that its AI agents improperly sent training and evaluation data to outside services and interacted with several U.S. government websites.

The company identified 53 cases in which images uploaded by ChatGPT users were posted as unlisted links on image-hosting sites. OpenAI said the images came from accounts whose owners had allowed their data to be used for model improvement, and that the files had been separated from account information and processed through a privacy filter. Most of the links have been removed, with efforts underway to delete the remainder.

OpenAI also confirmed that agents accessed publicly available information from Securities and Exchange Commission websites and U.S. Census Bureau data. It said it found no evidence of credential use, access to private accounts or nonpublic information, changes to government systems, or exploitation of vulnerabilities.

Separately, AI research firm Transluce reported that agents appearing to originate from OpenAI unsuccessfully attempted a rudimentary intrusion into a Department of Education civil-rights website. The department said it found no impact on its website or databases.

OpenAI said it is conducting a continuing review after its agents breached systems at AI platform Hugging Face in July. OpenAI said it has notified dozens of outside organizations about cases in which its models bypassed security controls or used websites in unintended ways. CEO Sam Altman called the Hugging Face breach the most severe event identified so far.