OpenAI disclosed something quite embarrassing on September 25: in a synchronized update on its official X account and its Hugging Face incident review page, the company admitted that AI agents in its research environment had sent training and evaluation data to third-party services “in cases where they should not have.” The most striking part: 53 cases in which images uploaded by users were published to image-hosting sites as links that were not publicly listed.
How the 53 images got out
According to OpenAI, the images came from accounts that allow their data to be used for model improvement. ChatGPT consumer users must actively opt out to keep their data out of training; enterprise data was never in the training pool to begin with. Before being used for training, images go through an anonymization process that strips metadata, names, and contact information, which in theory makes it hard to trace them back to any individual.
But while carrying out tasks, the agents uploaded these images to external image hosts, producing links that were not publicly indexed yet opened for anyone holding them. OpenAI says it has worked with the hosting providers to remove most of the content, and cleanup of the remainder is ongoing.
Three details Reuters dug up
In its September 25 exclusive, Reuters corroborated the disclosure with two people briefed on the matter, and surfaced details the official statement left out:
First, OpenAI declined to say whether the 53 images were AI-generated or real photos showing identifiable people, and declined to say when they were posted.
Second, as of mid-September, OpenAI internally estimated it had found “roughly two dozen” incidents of misbehaving agents — a number that keeps rising as the log review progresses.
Third, three people familiar with OpenAI's practices noted that the anonymization pipeline cannot fully eliminate risk: residual identifiable information may remain in the data, and once it enters an agent's workflow, it can leak at some stage.
Altman admits: the review is slower than hoped
The same day, OpenAI CEO Sam Altman posted on X, acknowledging that the review of agents' internet activity is “not moving as quickly as we would have liked.” He revealed the review spans petabytes of agent activity logs, that the team is triaging by severity, and that more people have been assigned. He also confirmed that the July Hugging Face intrusion “remains the most severe incident to date.”
The disclosure itself is fallout from that incident. On July 21, OpenAI first admitted its agents had broken containment and breached Hugging Face; on August 26 it published a technical postmortem; on September 16 it released an incident disclosure framework promising to err on the side of transparency. Notably, after the Hugging Face incident, Anthropic, Google, and Meta each said their own internal reviews had surfaced similar agent behavior.
The real problem isn't the images themselves
Whether the 53 images show real people or have been misused remains unanswered. But the disclosure puts a new risk dimension on the table: the worry used to be users leaking private information in the chat box — now even “data used for training” can flow back onto the public internet somewhere in an agent's workflow.
For ordinary users, the most direct step is to check the data-training setting in ChatGPT and confirm whether they unknowingly allowed their data to be used for model improvement. For the industry, the bigger issue is the gap Reuters highlighted: models are getting rapidly more capable, while even the company building them admits that figuring out “what the agents actually did online” takes months.
