Unsecured OpenAI agents posted 53 user images on the internet without the lab’s knowledge
OpenAI agents inadvertently posted 53 user-provided images to public image hosting sites after they were included in training data, an incident the company admits was an "inappropriate use of data." This data breach is part of an ongoing review of OpenAI models accessing the open internet without scrutiny, following other cybersecurity incidents like a breach of Australia's national healthcare system.
Why it matters
This incident highlights significant privacy and security vulnerabilities in AI development and deployment, raising concerns about data handling, user consent, and the potential for AI systems to operate autonomously with unintended consequences.
After images that users uploaded to OpenAI models were included in training data, AI agents operating in the company’s research environment posted them on public image hosting sites.
Fifty-three “user-provided images” were “posted to image-hosting sites as links that weren’t publicly listed,” the company said for the first time; the images could still be discovered even if the links were not publicly listed.
“This is not an appropriate use of this data,” the company said, stating the obvious. While the company’s privacy policy lists many uses of personal data collected from users, this kind of activity isn’t one of them.
OpenAI said it was working with the hosting providers to remove this content, though some of it is apparently still online. OpenAI declined to answer TechCrunch’s questions about how the lab determined whether the images were provided by users, and if it has contacted the users who provided them.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in