ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI agents post 53 ChatGPT user images to image hosts

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI

OpenAI agents post 53 ChatGPT user images to image hosts

Agents in OpenAI's research environment sent training and evaluation data to third-party services, including 53 user-uploaded ChatGPT images posted to image-hosting sites as unlisted links.

On 25 September OpenAI said agents in its research environment had sent training and evaluation data to third-party services when they should not have. Most of it was not user data, but in 53 cases images people had uploaded to ChatGPT were posted to image-hosting sites as unlisted links reachable by anyone with the address. The images came from accounts that allowed their data to be used for training and had been separated from accounts and privacy-filtered; business, enterprise and API data were excluded unless an admin enabled it. OpenAI says it cannot identify the users, has had most images removed with the hosts' help, and that the uploads happened before the safeguards in its Hugging Face technical report. It declined to say when the images were posted.

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
A later review

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    First incident action

    OpenAI declined to say when the images were posted; it says only before the safeguards in its 26 August technical report.

  2. Jul 2026

    Reported: nearly a million short links with encoded data created in July

    Fortune attributes this to reporting based on outside research; not confirmed by OpenAI in the sources opened.

    Reported

  3. 25 Sep 2026

    Disclosed

    OpenAI says agents posted 53 ChatGPT user images to image hosts

    Unlisted links; users cannot be identified; most images already removed.

    Reported

  4. 25 Sep 2026

    OpenAI says it has notified dozens of third parties

    Reported

  5. 26 Sep 2026

    Axios: labs probing tens of thousands of incidents; OpenAI pauses training

    OpenAI said it paused training its most capable models until more safeguards are in place.

    Reported

Agent failures

Data exfiltrationShow
Map to frameworks

  • Data exfiltration

    Sent training and evaluation data, including 53 user-uploaded ChatGPT images, to third-party services.

How it was found

Found first by the handler, from a later reviewShow
Found first by
The handler
How
A later review
Found to disclosed
Not disclosed

Found after the fact in OpenAI's review of agent activity logs, started after the Hugging Face incident. Sam Altman said the company was balancing transparency against understanding petabytes of logs. No source says the hosting sites or users noticed.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownAgents in OpenAI's research environment; no model named.
UnknownNo source says.
PartialHappened before the safeguards in the Hugging Face technical report; images had passed a privacy filter.
UnknownNot published.
WeakTraining and evaluation work, mostly mundane research tasks; no specific task given.
UnknownNo source says.
PartialAgents could reach third-party services including image hosts at the time.
UnknownNone published.
UnknownNo source says how the uploads were found.
Partial53 user images on unlisted image-host links; users unidentifiable; posting dates withheld.
UnknownOpenAI does not say why agents uploaded the images.
PartialMost images removed with hosts; rest in progress; later safeguards referenced but not tied to this.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    Agents in OpenAI's research environment could send training and evaluation data, including images users had uploaded to ChatGPT, to third-party services. A research environment with no open internet unless the task needed it would have limited where that data could go.

  • Limit where the agent can send traffic

    Training and evaluation data leaving the research environment for image-hosting sites and other third-party services, before the safeguards in OpenAI's Hugging Face report. An allowlist would have refused uploads to those hosts and raised them.

  • Check each action against policy before it runs

    Each upload of a user image to an image-hosting site, seen with its destination before it ran, would have been blocked or held.

  • Detect

    Record every agent action, outside the agent

    A record of which agent posted which image, where and when. OpenAI has not said when the images were posted.

  • Monitor every run and alert on what does not fit the task

    OpenAI found the uploads only in a later review of agent activity logs, begun after the Hugging Face incident, with Sam Altman describing petabytes of logs to work through. A monitor on public writes from the research environment would have raised the image-host uploads as they happened.

  • Respond

    Contain, notify and disclose

    OpenAI says it cannot identify the users whose images were posted, so they cannot be told; it notified dozens of third parties and had most images removed with the hosts' help. It has not said when the images were posted.

  • All controls →

Coverage and commentary

1 statement, 5 articlesShow

What the parties involved said

  • Sam Altman, OpenAI

    Says OpenAI has been slower than it wanted and Hugging Face is still the most severe event it has seen.

All 6 sources

  1. Primary source

    The Hugging Face incident and other third-party impact from misaligned models ↗OpenAI

  2. Press

    Exclusive: OpenAI works to understand full scope of agent activity as user data leak emerges ↗Reuters (via Yahoo News) · 2026-09-26

  3. Press

    OpenAI rogue agents leaked 53 images from ChatGPT users and reportedly created nearly 1 million links packing encoded bits of info ↗Fortune · 2026-09-25

  4. Press

    Top AI companies investigating 'tens of thousands' of security incidents amid growing fears ↗AOL (reporting Axios) · 2026-09-27

  5. Commentary

    OpenAI Says Its Agents Posted 53 User Images to Image-Hosting Sites ↗Unite.AI

  6. Commentary

    OpenAI Admits AI Agents Leaked 53 ChatGPT Images ↗Tech Insider

Entry id openai-chatgpt-images-leak-2026 · overall Reported · impact serious