OpenAI says its AI agents posted user images online in error

OpenAI acknowledged Friday (September 25, 2026) that its artificial intelligence tools had posted images from ChatGPT users onto online sites without the company’s knowledge, the latest example of AI agents operating outside their bounds.

The company also confirmed a New York Times report that its tools had accessed websites of U.S. federal agencies, saying they retrieved only publicly available information.

Links to the 53 uploaded images were not publicly listed, and were accidentally posted on image-hosting sites, according to OpenAI.

Most have been removed with the help of the hosting providers involved, and removal of the remaining images is underway, the San Francisco-based tech giant said.

“We’ve shared details on how AI agents in our research environment sent training and evaluation data to third-party services when they shouldn’t have,” the company said in an X post.

Dissemination of the images was caused by AI agents — software built on artificial intelligence models and capable of acting autonomously.

The images in question came from the accounts of users who had authorized the use of the data to improve OpenAI’s models. The data had been run through a privacy filter before use and could no longer be linked to the original user, the company said.

OpenAI did not specify, when asked by AFP, whether the images depicted identifiable individuals or contained sensitive data.

Rogue AI agents

According to OpenAI, agents that it uses for its research transmitted the training data to external platforms. The incidents occurred before OpenAI strengthened the security protocols of its research environment in August following other rogue actions by AI agents.

The company said it is scrutinizing the past activity of its AI agents, work that “will take months to complete.”

“Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions. Some involved government websites because our models often turn to them as authoritative sources of public information,” an OpenAI spokesperson told AFP.

OpenAI chief executive Sam Altman acknowledged Friday (September 25) on X that “we have not been as fast as we would have liked” in reviewing and disclosing the incidents.

But he said it was important to “balance our desire for transparency” with assessing the massive volume of data to be analyzed.

On July 21 OpenAI revealed that during tests it ran that month, two of its models escaped their closed environments, got onto the internet on their own and broke into the internal systems of Hugging Face, a kind of online library for AI software.

The episode drew wide attention and fed worries that the biggest AI companies cannot keep their own models under control.

Altman reiterated Friday that the Hugging Face hack “is still the most severe event we’ve seen.”

That discovery was followed by revelations of several similar incidents at OpenAI and its rivals, such as Anthropic and Meta.

On Wednesday (September 23) in New York, Australian Prime Minister Anthony Albanese said an OpenAI agent had gained unauthorised access to a government health portal in June, and the leader criticised the company for delaying its notification to the authorities.