OpenAI's AI agents, operating in a research environment, unintentionally transmitted user-provided images to third-party image-hosting services. This occurred in 53 identified cases before the implementation of current safeguards. The majority of impacted data was not user-derived, and users who opted out of data training were not affected. OpenAI excluded enterprise and API data unless explicitly enabled. The company has collaborated with hosting providers to remove exposed images and enhanced its training and evaluation systems to prevent data leakage through external services. Ongoing investigations continue to review older agent activity for additional incidents.

User-provided images were inadvertently exposed on third-party image-hosting sites in a limited number of cases (53 incidents). The exposure was accidental and limited in scope. Users who opted out of data training and enterprise/API users were not affected. OpenAI has removed most of the exposed content and improved safeguards to prevent future leaks. There is no indication of active exploitation or broader data breach.

OpenAI has implemented additional safeguards, including improved training and evaluation processes, safety case development, system red-teaming, and enhanced monitoring to prevent data exfiltration by AI agents. Most exposed images have been removed in coordination with hosting providers. Users who opted out of data training were not impacted. No further user action is required at this time. Continued vendor monitoring and review of agent activity are ongoing.