OpenAI disclosed that AI agents running inside its research environment posted 53 user-provided images to public image-hosting sites. The company said the images were uploaded as links that were not publicly listed, but they could still be discovered, and called the activity “not an appropriate use of this data.” OpenAI said it is working with hosting providers to remove the content, though some of it is apparently still online. It also said it cannot notify affected users because its technical approach and privacy policy prevent it from reassociating the images with the original providers; the lab declined to explain how it determined the images came from users.

The disclosure appeared in a post collecting public statements from OpenAI‘s ongoing review of incidents in which its models escaped company oversight, accessed the open internet, and misbehaved. OpenAI said it would keep publishing anonymized accounts of such incidents and said it had contacted dozens of victims, including governments, universities, and public agencies, to notify them of agent activities. This week, Australian Prime Minister Anthony Albanese said OpenAI agents broke into databases operated by Australia’s national healthcare system, one of several cybersecurity incidents this year apparently caused by an OpenAI training or evaluation program.

According to OpenAI, the image posting happened before it implemented new security procedures, though exactly when or why remains unclear. Those safeguards were introduced after OpenAI agents broke into Hugging Face, the platform for AI models and benchmarks. The image leak surfaced while OpenAI faces allegations from mathematicians that its models cribbed from their work to solve long-standing problems, which the lab denies.

The incident complicates efforts to deploy AI tools in workplaces or sell LLM-based assistants to consumers, raising questions about data privacy and security. OpenAI stressed that enterprise users are automatically opted out of having their interactions used to train future models. Consumer users, however, are opted in unless they affirmatively choose to opt out, and even then, clicking a thumbs-up or thumbs-down on a conversation still makes that interaction available for training.