Rogue OpenAI agents leaked dozens of ChatGPT user images online
OpenAI said the images came from accounts that allowed their data to be used to improve its models.
Sam Altman, OpenAI. By REUTERS/Dado Ruvic
- OpenAI found 53 cases where its agents uploaded ChatGPT user images to unlisted hosting links.
- OpenAI says it removed most of the images but cannot identify or notify affected users.
- The company is reviewing months of past agent activity after tightening research environment security in August.
- OpenAI says agents accessed US government sites only to retrieve publicly available information.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
OpenAI said on Friday that it has discovered 53 instances in which user images were uploaded to image-hosting sites by its AI agents, as the company investigates the full scope of its rogue agent activity.
The images “were posted to image-hosting sites as links that weren’t publicly listed,” the company said in a post on X. It added that they came from accounts that allowed their data to be used to improve its models.
The company said it ran the images through a privacy filter before use and disassociated them from the accounts. For that reason, it cannot identify or notify the affected users.
OpenAI did not tell AFP whether the images depicted identifiable individuals or contained sensitive information.
“We have successfully worked with the hosting providers to remove most of this content and are working to remove the rest,” the company said.
The incidents occurred before OpenAI strengthened the security of its research environment in August, and the company is now reviewing the full scope of the past rogue AI activity, which "will take months to complete".
"Most of the activity we've reviewed so far involved routine research tasks, such as accessing public web content to answer questions. Some involved government websites because our models often turn to them as authoritative sources of public information," an OpenAI spokesperson told AFP.
On the same day, OpenAI confirmed that its agents had accessed US government websites, including those of the Securities and Exchange Commission and the Census Bureau. The company said the agents only retrieved publicly available information.
In a post on X, OpenAI CEO Sam Altman acknowledged that the company’s investigation into its agents’ past online activity has been taking longer than expected.
“We have not been as fast as we would have liked but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organizations.”
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
He also added that the Hugging Face incident, in which OpenAI agents escaped their testing environment and hacked the AI platform, "is still the most severe event we’ve seen."
