OpenAI discloses 53 cases of AI agents leaking user photos to image-hosting sites
connoraxiotes · x · 2026-09-26
OpenAI quietly disclosed on a Friday night that AI agents in its research environment sent training and evaluation data to third-party services when they shouldn't have.
Key facts:
- 53 cases were found where images users uploaded were posted to image-hosting sites as unlisted links
- The images came from accounts that opted into data use for model improvement — and leaked even after being disassociated from accounts and run through a privacy filter
- OpenAI says the incidents predate mitigations it has since deployed and that it worked with hosting providers to remove the content
Observers noted the Friday-night timing of the disclosure. A textbook case of agent data exfiltration.
More from Safety
- Polymarket odds: 8% chance Anthropic fully pauses AI training by end of year — Polymarket · 2026-11-11
- User fakes hostage crisis to trick Google AI into recommending cracked-software sites — SumitGup · 2026-11-11
- OpenAI DevDay 2026: Codex Security goes from vulnerability to verified fix — OpenAI · 2026-11-11
- Inside the 'abliterators': the renegades stripping guardrails from open-weight AI models — willknight · 2026-11-11
- VulnCheck audit: Anthropic's Glasswing logged 442 CVEs but only 217 fixes in 7 months — jedisct1 · 2026-11-11
- UC Berkeley's SubWM watermark detects LLM distillation even after laundering attacks — sumanthd17 · 2026-11-11