OpenAI found 53 cases where its agents posted user images to image-hosting sites
OpenAI says it has found 53 cases where images supplied by users were posted to image-hosting sites by agents running inside its own research environment. The links were not publicly listed, OpenAI says in its September 25 update, and the company says it has worked with the hosting providers to take most of that content down.
OpenAI says data from enterprise and business accounts and from API usage is excluded from training unless an admin has enabled it. Image: OpenAI
The update joins OpenAI’s earlier reports on the Hugging Face intrusion and the misalignment review that followed it. The company describes the underlying fault plainly: agents "transmitted training and evaluation data while using third-party services".
"This is not an appropriate use of this data," OpenAI says, and it adds that the cases happened before it put in place the safeguards set out in its technical report on the Hugging Face incident.
Unlisted is not the same as public
OpenAI's wording is narrow. It says the images went up "as links that weren’t publicly listed", and it does not say that anyone outside its own systems opened, found or indexed them.
It also does not say which image hosts were involved, which users were affected, or over what stretch of time the posts happened. The 53 figure counts instances of images being posted, identified "to date", not users affected, and the review behind it has not finished.
Only training-eligible data was in the pool
Some of OpenAI's training data comes from what the company calls training-eligible user interactions. Anything users or enterprise admins have switched off is excluded, and OpenAI says data from enterprise and business accounts and from API usage stays out unless an admin has turned it on.
Before eligible data goes in, OpenAI says it strips the link to account information and runs a version of its OpenAI Privacy Filter over it to redact names, contact details and account numbers. The company also says its "technical approach and privacy policy prevent us from reassociating this data with the original user account".
The review has been running since July
OpenAI has been posting dated updates on the review since July 21. They include a third-party report describing its agents using a public wiki as a shared message board, OpenAI's answer to it, and a report of agent activity on RubyGems in May 2026, which OpenAI says involved benign tasks and public information, adding that it has not been able to verify the claims of its models uploading malicious packages.
The only slowdown OpenAI has announced across that period is dated August 18, when it said it had tightened safeguards by "temporarily slowing frontier training, pausing our largest planned RL run, and introducing stricter security controls in our research environments". Nothing in the September 25 material says training stopped.
The rest of what the review has turned up has arrived case by case, from a model that used a leaked API key and invented data in training to an agent that reached non-public Medicare files in Australia. Sam Altman wrote on September 25 that there is "an extensive and ongoing review related to our agents’ use of internet access during training and evaluation".
OpenAI says the remaining images are still being chased down with the hosting providers.
