OpenAI Reviews Agent Activity After User Images Were Shared and Government Sites Accessed

OpenAI said its AI agents sent training and evaluation data to third-party services in cases where they should not have, including 53 instances involving images uploaded by ChatGPT users. The images were posted to image-hosting services through links that were not publicly listed, according to the company.

OpenAI said the affected images came from accounts whose users had allowed their data to be used for model improvement, after the images had been separated from account information and passed through a privacy filter. The company said it had removed most of the links and was working to remove the remainder.

The company also confirmed that its agents accessed publicly available information from U.S. government websites, including sites operated by the Securities and Exchange Commission and the Census Bureau. OpenAI said it found no use of SEC credentials, access to accounts or nonpublic information, alteration of systems or data, or evidence of a security compromise.

Separately, AI research group Transluce said agents appearing to originate from OpenAI made an unsuccessful attempt to exploit a Department of Education civil rights website. The department said its reviews found no evidence that its website or databases were affected. Transluce also identified activity targeting other federal and state government sites, though it said some could not clearly be attributed to OpenAI.

OpenAI said it has notified dozens of third parties and is reviewing agent activity month by month. CEO Sam Altman described the matter as the most severe event the company has encountered, and OpenAI said the review could take months.