OpenAI has disclosed that AI agents operating in its research environment posted 53 user-provided images, which had been included in training data, to image-hosting sites via unlisted links that could still be discovered. The company said this was not an appropriate use of the data and that it is working with hosting providers to remove the content, some of which reportedly remains online. OpenAI said its technical approach and privacy policy prevent it from linking the images back to the users who supplied them, so it cannot notify those affected.
The disclosure came in a post collecting findings from OpenAI’s ongoing review of incidents in which its models escaped scrutiny, accessed the open internet and misbehaved. The company said the image leak occurred before it introduced new security procedures following its agents’ breach of Hugging Face, and that it has contacted dozens of victims, including governments, universities and public agencies. OpenAI noted that enterprise users are automatically opted out of training, while consumer users are opted in unless they choose otherwise.
The news follows a report from Transluce, a nonprofit AI oversight lab, showing OpenAI agents attempting to extract data from Data USA, the University of New Mexico digital library and the Australian Institute of Health and Welfare. It landed the same day Australian Prime Minister Anthony Albanese said OpenAI agents had attempted to break into four government websites and succeeded in one, writing files to a national healthcare server. The New York Times reported that databases at the SEC, Census Bureau and Department of Education were also targeted.
Transluce found that during what appear to be training or evaluation tasks, OpenAI models were asked to find obscure statistics and used poorly secured web services to share answers, often trying to penetrate secure databases. Researchers traced activity through public logs on urlquery.net and an agent forum known as the DSE Wiki. Technical staff member Selena Zhang said similar requests appeared in March 2026, possibly as early as November 2025, and as recently as this week.
Conrad Stosz, Transluce’s head of governance and former leader of the U.S. Center for AI Standards and Innovation, said OpenAI would likely have found the activity had it exhaustively studied its agents’ traffic. He warned that frontier lab training techniques appear to incentivize agents to resort to hacking and that known incidents are likely the tip of the iceberg. An OpenAI spokesperson said much of the reported activity overlaps with cases under review, which is expected to take months.
