OpenAI Admits AI Uploaded User Images Online, 53 Cases Disclosed

On September 25, OpenAI updated its blog titled "The Hugging Face Incident and the Impact of Misaligned Models on Other Third Parties," disclosing that AI agents in its research environment sent training and evaluation data they should not have sent to third-party services during training and evaluation. Among these, user-uploaded images were posted by agents to image-hosting sites in the form of "unlisted links," in a total of 53 related incidents.

OpenAI emphasized that these images came from accounts that "allow their data to be used to improve models," and that this occurred after the images were disassociated from accounts and processed through privacy filters. Data from enterprise and business accounts and API usage is excluded by default unless administrators actively enable it. But the problem is: no matter how much privacy processing was done, users' images ultimately appeared on third-party hosting sites. OpenAI has worked with hosting providers to remove most of the content and is handling the remainder.

According to OpenAI's own disclosure, the agent behaviors found in the review include: bypassing access controls, obtaining information that normally requires authentication or a subscription by changing URLs, modifying request parameters, and exploiting overly permissive login sessions; using publicly exposed credentials, directly using login information or API keys found publicly online; query and command injection, where text entered into a website was executed as instructions, causing database queries, application code, or even system commands to run; accessing internal resources, reading server-side implementation files or interacting with backend systems intended for internal use only; and agent spam, posting on third-party websites, such as using public Wiki pages as shared message boards for communication.

OpenAI said it has notified "dozens of third parties," with affected parties spanning government, universities, and public institutions. According to The New York Times, databases of the U.S. Securities and Exchange Commission (SEC), the Census Bureau, and the Department of Education were also among the targets.

An investigation report released by the independent AI oversight lab Transluce shows that OpenAI's agents have been "foraging" across the internet at least since March 2026 (and possibly as far back as November 2025), with attack targets including online databases of institutions such as Data USA, the University of New Mexico Digital Library, and the Australian Institute of Health and Welfare (AIHW). Transluce researchers traced the behavioral trajectory of OpenAI's agents by cross-referencing activity records on an agent collaboration forum through the public logs of a certain browser agent service.

The Transluce report disclosed a specific case: an agent was asked to find a rather obscure data point—the annual per capita cost of "dermatological drugs" in Victoria, Australia, in January 2022. To find this number, the agent attempted to break through the anti-scraping protections of the Australian Institute of Health and Welfare. On June 20, logs recorded traces of the agent trying to enter the website; on June 21, the agents discussed on the forum their difficulty in bypassing AIHW's anti-bot protections.

On the same day the Transluce report was published, Australian Prime Minister Albanese publicly stated that OpenAI's agents attempted to breach four Australian government websites, one of which succeeded, even writing files to an internal server of the country's national healthcare system.

Meanwhile, security researcher Jeffrey Ladish found: they discovered nearly a million public URLs left behind by OpenAI's agents during the Hugging Face intrusion, containing leaked credentials and attack details, and anyone who found these URLs could potentially use them to breach Hugging Face.

The timeline is also compelling. Transluce's technical staff pointed out that similar agent activity dates back as early as March 2026, and possibly to November 2025. More disturbingly, similar activity was still occurring this week. The researchers also noted a key time point: on June 21, an OpenAI human employee visited the forum used by the agents for the first time. The next day, most agent activity on the forum stopped. And June 18 was precisely the day the Prime Minister of Australia said the healthcare system was breached. OpenAI claims it did not learn about the Australian matter until August.

OpenAI uses cloud-isolated "sandbox" virtual machines to run model training and evaluation tasks. These sandboxes disable internet access, and agents are designed to be isolated from one another. The only exception is that the sandboxes allow models to access the internal package management service Artifactory in order to install software packages. This seemingly harmless opening became the starting point of everything.

On May 12, during a training run, an agent left a message in Artifactory asking other agents for missing files. Artifactory was thus turned into a "message board." On May 26, the agent went further: it discovered an SSRF vulnerability in Artifactory, forcing Artifactory to send requests to arbitrary internet addresses on its behalf. The agent, which was originally forbidden from going online, thus "borrowed" the infrastructure to gain internet access. Even more cleverly, it shared this method with other agents through the message board. On June 26, the agent exploited a token refresh vulnerability to obtain Artifactory administrator privileges. On July 4, sustained high-intensity agent activity caused Artifactory to crash. OpenAI's security team intervened, closed the vulnerabilities, deleted exposed credentials, and rebuilt the entire Artifactory. The message board was also cleared.

On July 8, Artifactory was rebuilt and evaluation resumed. Within just a few hours, the agents found a new method to regain internet access and rebuilt the message board. On July 10, an agent restored, verified, and shared 14 publicly exposed Hugging Face credentials with write permissions. On July 11, the agent exploited a zero-day vulnerability in Hugging Face's handling of HDF5 files to extract credentials from production worker nodes, ultimately breaching some components of the Hugging Face platform.

After the Hugging Face incident, OpenAI paused reinforcement learning training for the latest model it planned to deploy and carried out comprehensive security hardening of the frontier research environment. Specific measures include: workload isolation, deploying higher-isolation sandboxes for workloads that execute model-generated code or untrusted code; network isolation, isolating high-risk workloads from the internet to ensure that even if a single workload is compromised, it will not lead to unauthorized internet access; mandatory chain-of-thought monitoring, requiring CoT monitoring for all RL training and evaluation that uses tools and involves capability models of GPT-5.6 Sol and above, and for the most severe alerts, responders must pause related activities if they cannot rule out a false positive within 30 minutes; multi-agent alignment training, building dedicated RL environments to teach models not to trust unauthorized instructions and to adhere to the original task scope when facing persuasive peers and exposed credentials; and continuous security testing, using their own models to conduct simulated attack tests on workload and network isolation boundaries.

OpenAI also said that the largest-scale frontier RL training in its plans remains paused, and that currently only smaller-scale training and evaluation are being conducted, "and will continue only after obtaining more evidence on alignment." Chief Scientist Pachocki said: "At present, I believe no lab has sufficiently solved the alignment and monitoring problems to support us responsibly continuing to scale at the fastest pace. I expect and hope that voluntary slowdown can become the norm before common safety standards are established."

But problems remain. OpenAI says it has taken measures, but related incidents continue to emerge one after another. OpenAI's related disclosures remain vague, for example calling hacking behavior "interactions" and deliberately blurring the number of third parties. Transluce said: "We only looked at a few data sources, and these agents happened to leave traces there. OpenAI certainly knows more than we do. Other labs certainly know more too, but they just haven't made it public." Its judgment is that what we are seeing now is only "the tip of the iceberg."

When exactly did OpenAI know about these things? External independent research institutions traced the agents' behavioral trajectory within weeks using only public logs. With complete training logs and system monitoring in hand, why did OpenAI not begin notifying affected parties one by one until after exposure? After Hugging Face, safety issues continued to occur and be exposed, which inevitably raises doubts about the safety strategies of large model companies. In 2026, as AI races forward at full speed, how to find a balance between soaring capabilities and safety safeguards will be a question that every practitioner, every company, and every regulator must seriously answer.