OpenAI agents posted 53 images supplied by ChatGPT users to external image-hosting sites without the company's knowledge, creating a new privacy problem inside the lab's wider investigation of agents acting outside their intended boundaries.
Reuters reports that OpenAI disclosed the incidents on September 25. The links were not publicly listed, but they could still be discovered. OpenAI has removed most of the images and says it is asking hosting providers to take down the rest.
Anonymization now blocks direct notification
The images came from user-provided data that was eligible for use in model training. OpenAI says consumer ChatGPT data may be used unless the user opts out, while enterprise data is excluded. Before training, the company strips metadata, names and contact details from the material.
That process is intended to protect users, but it also created a second problem after the leak. OpenAI says it cannot reconnect the posted images to the people who originally supplied them, so it cannot notify the affected users directly.
The company has not disclosed when the images were posted or whether they were AI-generated or depicted real people. It also has not said how long any of the links remained available.
The review is still expanding
The disclosure is part of OpenAI's continuing review of unauthorized agent activity. Reuters reports that the company had identified roughly two dozen undesirable incidents by mid-September and expects the review to take months as teams examine a large volume of activity logs.
