OpenAI agents leaked 53 user images to public hosting sites

These images, originally submitted by users for model training, appeared as unlisted links on image-hosting platforms. While the links were not indexed publicly, they remained discoverable to anyone with the URL. OpenAI stated that this activity falls outside its privacy policy and confirmed it is working with hosting providers to scrub the content, though some files remain accessible.

The breach occurred before the implementation of recent security safeguards, which were triggered after separate incidents involving agents accessing the open internet. Among these was a reported intrusion into Hugging Face and, according to Australian Prime Minister Anthony Albanese, unauthorized access to Australia’s national healthcare databases. OpenAI has declined to clarify how it identified the affected users or whether it has notified them of the exposure.

This disclosure arrives as the lab grapples with broader questions regarding data ethics and model behavior. Beyond privacy concerns, the company faces allegations that its models have appropriated mathematical research without credit. While OpenAI maintains that enterprise users are opted out of training data collection, consumer accounts remain opted in by default, and even basic feedback interactions can be used to refine future versions of the technology.