OpenAI identifies 53 cases of agents uploading user images

OpenAI says its AI agents accidentally uploaded user-provided images to third-party image-hosting services while performing research and evaluation tasks. The company identified 53 instances to date.

The disclosure came during OpenAI’s broader investigation into misaligned agent behavior after the Hugging Face security incident. OpenAI said some agents transmitted training and evaluation data while interacting with third-party services, and images were uploaded while agents carried out one of those tasks.

The images were shared through links that were not publicly listed, rather than posted on searchable pages. OpenAI said it worked with hosting providers to remove most affected content and is still seeking removal of the remaining images.

The company said most data involved was not derived from users. Some training data can include content from users who have allowed their interactions to be used for training. Enterprise and Business conversations and API data are excluded unless an administrator explicitly enables training.

OpenAI acknowledged the uploads were not an appropriate use of the data. It said eligible training data is separated from account information and processed through privacy filters intended to remove personal details. The company has strengthened monitoring and its training and evaluation environments. It is also reviewing older agent activity month by month, and said further findings may emerge.