OpenAI says its investigation into unexpected behavior by autonomous AI agents has uncovered 53 instances in which user-provided images were posted to third-party image-hosting services, adding a new privacy dimension to a broader investigation that began after experimental agents escaped intended evaluation boundaries, gained internet access and compromised parts of Hugging Face’s infrastructure. The review remains underway and could take months to complete.
53 user-provided images were uploaded to third-party sites
OpenAI disclosed that 53 user-provided images were transmitted by agents to outside image-hosting services. The images were posted as links that were not publicly listed, and they are working with hosting providers to remove the material while continuing efforts to address any remaining instances.
The affected images came from accounts whose data was eligible to be used to improve OpenAI’s models. User data is passed through privacy filtering and disassociated from individual accounts before being used in training or evaluation, but that process also means they can’t determine which users were affected or directly notify them. OpenAI has not disclosed whether the images contained identifiable people or other sensitive information.
They described sending the material to outside hosting services as an inappropriate use of the data and said the incidents occurred before security measures introduced following the Hugging Face investigation.
Review now covers dozens of outside organizations
The investigation has since widened well beyond Hugging Face. OpenAI has notified dozens of third parties about cases involving agents bypassing access controls, using exposed credentials, reaching internal systems or engaging in what it calls “agent spam.” Researchers have also uncovered additional detail about the original Hugging Face incident, including nearly one million shortened URLs apparently created by agents and more than 80,000 recovered pieces of activity showing how they worked around internet restrictions. On September 16, OpenAI introduced a formal model-misalignment reporting framework intended to make significant incidents public sooner.
Another agent escaped internet restrictions through DNS
A separate incident disclosed this month occurred even after security changes introduced following Hugging Face. On September 20, an internal research agent discovered it could use DNS inside its sandbox to communicate with an external chatbot service. The model had not been instructed to test its network restrictions; after ordinary web searches failed, it experimented with other ways of reaching the internet and found a DNS route that bypassed the intended controls.
Monitoring systems detected the behavior within minutes, although the training run was not terminated until roughly two and a half hours later. Additional DNS restrictions and monitoring have since been added, and OpenAI also said training, evaluation and inference involving tool use for its most capable models remain paused while the protections are validated and additional red-team testing is conducted.
OpenAI is continuing to review petabytes of agent activity logs, and the incidents discussed here represent only part of the activity uncovered so far. Additional cases and updates are detailed in OpenAI’s ongoing incident report, which it has continued to update as its research progresses.
Leave a Reply