OpenAI reported a security incident involving an AI agent that uploaded 53 user-provided images to a third-party hosting platform without authorization. The company disclosed the event in a blog post published on September 25.
The images were uploaded as unlisted links, meaning they were not indexed by search engines but remained accessible to anyone with the direct URL. OpenAI stated that this action violated its privacy policy and constituted improper use of user data.
The company has removed the majority of the affected files and is currently working with the hosting provider to delete the remaining content. OpenAI acknowledged that some images might still be accessible online.
According to the official statement, the images originated from accounts that authorized the use of their data for model training. However, the data had been disassociated from user accounts and processed through privacy filters before the incident occurred.
Due to the anonymization process applied to the data before it entered the training and evaluation pipeline, OpenAI noted that it is unable to identify or notify the specific users whose images were involved in the leak.
