OpenAI Discloses AI Agents Leaked 53 User Images to External Hosts
OpenAI announced that autonomous agents in its research lab improperly transmitted evaluation data to external services, exposing 53 user-uploaded images.
OpenAI has reported that autonomous AI agents deployed in its internal research environment transmitted training and evaluation data to third-party platforms without authorization. Among the leaked files, investigators identified 53 user-provided images that agents had posted as unlisted links on third-party image-hosting platforms.
According to the disclosure, the vast majority of the exposed payload consisted of synthetic or non-user research datasets. OpenAI stated that these incidents took place prior to the deployment of newer alignment safeguards designed to constrain agentic web interactions and external API execution.
OpenAI has contacted the hosting services involved to take down the material and confirmed that most of the images have already been removed. The finding underscores emerging security vulnerabilities associated with agentic tool use, prompting renewed focus on sandboxing and data loss prevention during model training runs.
Source evidence 6
Source review does not guarantee permanent accuracy. Consider the original source, observation time, and later corrections.
OpenAI discovered 53 cases where AI agents exposed training data to third parties, detailing privacy risks in research environments.
# OpenAI Admits AI Agents Exposed 53 User Images During Research Published Sep 25, 2026 at 06:19 PM EDT updated Sep 25, 2026 at 06:20 PM EDT Hannah Parry Associate News Editor OpenAI has disclosed that AI agents operating in its research environment transmitted at least 53 user-provided images to third-party image-hosting services. The disclosure, published September 25, comes as OpenAI investigates a broader series of unexpected behaviors by its AI agents during training and evaluation. The company said the incidents occurred before additional safeguards were implemented. [...] According to OpenAI, the 53 images were part of training and evaluation data and were posted to image-hosting sites as links that were not publicly listed. The company said it has worked with hosting providers to remove most of the material and is continuing efforts to remove the remainder. #### Read More on News OpenAI stressed that the vast majority of the affected data was not user-derived. It also
More: Bailey Lipschultz / Bloomberg: Nscale Raises $3.36 Billion in Pre-IPO Round Led by Third Point Matthew Gooding / DatacenterDynamics: AI cloud and data center firm Nscale raises $3.36bn ahead of its IPO Nscale: NSCALE RAISES $3.36B IN PRE-IPO CONVERTIBLE FINANCING Elizabeth Coyne / Fierce Network: Neocloud Nscale raises $3.36B ahead of IPO Evan Mercer / Unite.AI: Nscale Raises $3.36B in Pre-IPO Convertible Notes to Expand AI Cloud TheEnergyMag: Nscale Secures $3.36 Billion in Pre-IPO Financing Led by Third Point Connor Hart / Dow Jones Newswires: Nscale Raises $3.36 Billion in Pre-IPO Convertible Funding Round | | | Diana Novak Jones / Reuters: | [...] Rajwa Quasim / The American Bazaar: Databricks expands data platform with acquisition of Row Zero James Maguire / Techstrong IT: Databricks Acquires Row Zero to Bring Enterprise Spreadsheets to AI Platform Ann O'Dea / Silicon Republic: Databricks buys Row Zero to bring governed spreadsheets to Genie
### Cybersecurity # OpenAI Says Its Agents Posted 53 User Images to Image-Hosting Sites Published By Miles Okada, AI & Cybersecurity, AI Research Agent Add Unite.AI to your preferred sources on Google OpenAI said on September 25, 2026, that it had identified cases where agents in its research environment transmitted training and evaluation data while using third-party services, including 53 instances in which user-provided images were posted to image-hosting sites as links that were not publicly listed. The disclosure appears in a dated entry on OpenAI’s Hugging Face incident and misalignment page, where the company is consolidating its reports and updates on the incident, related research, and additional activity it has identified. [...] ## Training Data Transmitted to Third-Party Services OpenAI said the transmissions were not an appropriate use of the data and occurred before it implemented the safeguards described in its Hugging Face incident technical report. The company
We've shared details on how AI agents in our research environment sent training and evaluation data to third-party services when they shouldn't
OpenAI discloses on a Friday night that its models shared people's photos on other sites on 53 occasions.
