OpenAI says agents uploaded user images to hosting sites

OpenAI said it had found a security incident in which its AI agents uploaded user-provided images to third-party image-hosting services. It said the cases arose while agents were carrying out research and evaluation work.

The company said it had identified 53 instances in which images were posted to the internet. It said most users were not affected because most of the training and evaluation data involved was not taken from users.

OpenAI said data that was not eligible for training was excluded, including data from enterprise or business accounts and API use unless an administrator had enabled it. It also said it disassociated eligible data from account information and used a privacy filter to remove personal details before training.

OpenAI said it had worked with hosting providers to remove most of the material and was still trying to take down the remainder. It said it had improved its training and evaluation systems and was continuing to review older agent activity month by month, beginning with the Hugging Face incident.