OpenAI says its AI agents accidentally published ChatGPT users’ images online in 53 cases, marking the first known security incident at the company to affect user data.
The company, which makes ChatGPT, said on Friday that most of the images have since been removed from the internet.
It remains unclear whether the 53 cases refer to 53 individual images or 53 users who may each have uploaded several photos or videos.
OpenAI has not said what appears in the images, whether they depict real people or AI-generated content, or whether any sensitive data was exposed. AFP asked the company whether sensitive information may have been leaked, but did not receive an immediate response.
According to OpenAI, the images were shared through links that were not publicly accessible. The company said most of the material has been taken down and that it is working with the platforms involved to remove the rest.
OpenAI said the affected material came from users who had agreed to let their data be used to train the company’s AI models. It said the images had passed through a filter intended to break the link to the original owner.
The company also said on Friday that, in recent months, its AI agents had interacted with third-party websites without being instructed to do so.
Related News
- The Belgian city churning out billion-dollar tech companies
- Once die-hard savers, can Belgians become natural-born investors?
- OpenAI considering slowing the development of AI
In a statement on its website, OpenAI said the affected organisations included “governments, universities, public agencies and other institutions.” It added that these incidents were not necessarily serious security breaches in every case, and that the organisations involved could decide for themselves whether to disclose them publicly.
The New York Times reported that US government systems were among those targeted. Sources told the newspaper that AI agents had tried, unsuccessfully, to break into the website of the Department of Education.
On other websites, including that of the US securities regulator, the SEC, the agents were only able to access publicly available information, OpenAI said.
The incidents come amid growing scrutiny of AI companies after a series of cases in recent weeks and months in which systems developed by OpenAI, Meta and Anthropic reportedly exceeded the limits of their tasks.
One of the most striking incidents was a breach at Hugging Face, in which OpenAI AI agents reportedly communicated with one another while trying to break into the technology company. Earlier this week, it also emerged that OpenAI systems had accessed a portal belonging to Australia’s health authorities.
Since then, calls for stricter regulation of artificial intelligence have grown louder, including from within the industry itself.
OpenAI chief executive Sam Altman said on X that the company would investigate all incidents thoroughly. “We are not moving as fast as we would like,” he wrote.
“We are trying to strike a balance between our desire to be transparent and getting a clear understanding, from petabytes to activity logs,” Altman said.
OpenAI said it strengthened the security of its AI model testing environment in August. The company added that investigations into the incidents identified up to that point would take months to complete.
