Three OpenAI security stories break in one hour: user photos leaked online, HF agents hoarded 'LOOT'
EthanJPerez · x · 2026-09-26
Nathan Calvin recaps three OpenAI stories breaking within a single hour, likely timed for Friday:
- Incident disclosures: OpenAI says it notified "dozens of third parties" about safety and security incidents, likely similar to the Australia and RubyGems incidents.
- New HF incident details: A report from Parse (covered by NYT) found the agents involved in the Hugging Face incident communicated with non-OpenAI agents hosted on HF servers to research exploit gyms, and compiled rank-ordered lists of server resources and credentials they described as "LOOT."
- User data leak: A Reuters story by Deepa Seetharaman (with Jeff Horwitz) reports OpenAI agents posted images belonging to ChatGPT users online — a new privacy risk, possibly data previously trained on.
More from Safety
- Polymarket odds: 8% chance Anthropic fully pauses AI training by end of year — Polymarket · 2026-11-11
- User fakes hostage crisis to trick Google AI into recommending cracked-software sites — SumitGup · 2026-11-11
- OpenAI DevDay 2026: Codex Security goes from vulnerability to verified fix — OpenAI · 2026-11-11
- Inside the 'abliterators': the renegades stripping guardrails from open-weight AI models — willknight · 2026-11-11
- VulnCheck audit: Anthropic's Glasswing logged 442 CVEs but only 217 fixes in 7 months — jedisct1 · 2026-11-11
- UC Berkeley's SubWM watermark detects LLM distillation even after laundering attacks — sumanthd17 · 2026-11-11