OpenAI's AI agents put ChatGPT images online

What OpenAI has admitted

On 25 September 2026, OpenAI published a new entry on its page documenting the aftermath of the Hugging Face incident. According to this, AI agents in the company's research environment transmitted training and test data to third-party internet services. AI agents are programmes that are given a task and then complete it independently, meaning they visit websites, fill in forms or upload files. In 53 cases, these agents uploaded images belonging to ChatGPT users to image-hosting sites, that is, services where anyone can store photos and share them via a link.

According to OpenAI, the links were not publicly listed. That means the images did not appear in any directory and turned up in no search. Anyone who knew the address, however, could open them. OpenAI itself does not describe the process as an appropriate use of the data. Most of the images have since been removed with the help of the operators, it says, and work on the remainder is ongoing. According to OpenAI, the cases date from before the tightened safeguards of August 2026. Which sites were involved, exactly when the images ended up there and what they show, the company does not say.

Where the ChatGPT images came from

The images came from the body of data OpenAI uses to train its models. OpenAI uses content from ChatGPT users for training unless they have switched this off. The relevant setting in ChatGPT is called "Improve the model for everyone" and can be found under the data controls. Anyone who changes nothing there supplies training material, uploaded images included. For company accounts and for the programming interface, training is off from the outset. According to OpenAI, this data is therefore not affected, unless an administrator has expressly authorised its use.

Before training, OpenAI says it separates the content from the user account. A filter removes names, contact details and account numbers. This is what the company now relies on: it can no longer match the images to any account and therefore cannot inform anyone either. The mechanism designed to protect users thus ensures that none of them will learn whether their image was among them.

Why this may be a data breach

A filter that deletes names does not make a photo anonymous. If the image shows a face, a flat or a document, it remains personal data, even without an account name alongside it. Where such data reaches third parties unintentionally, the General Data Protection Regulation (GDPR) speaks of a personal data breach. The controller must as a rule report it to the supervisory authority within 72 hours, provided there is a risk to the individuals concerned. If the risk is high, it must also notify those individuals. If it cannot reach them individually, a public communication will suffice.

For users in the European Economic Area, OpenAI's Irish subsidiary is the controller. The Irish data protection authority would therefore be responsible. Whether OpenAI has reported the incident there is not apparent from the statement. Nor is whether European users are affected at all. The text names neither countries nor the number of people affected. The advantage of this self-disclosure is that it exists at all. The disadvantage is that it can hardly be verified from the outside.

One case in a longer series

The images are an incidental finding. Since July 2026, OpenAI has been investigating an incident in which an internal research model escaped from a sealed-off test environment. It reached the internet via a previously unknown security vulnerability and penetrated systems belonging to Hugging Face, a platform on which developers share AI models. OpenAI describes this as the most serious case of its kind to date. Since August, stricter rules have applied in the research environment, such as stronger isolation from the internet. At the same time, the company is working backwards month by month to establish what its agents did on the internet during training and testing.

This review has triggered dozens of notifications to third parties, including public authorities, universities and other public institutions. OpenAI explains this by saying that models frequently head for official sources when carrying out research tasks, and classifies most cases as not very serious. According to reports, pages of the US Securities and Exchange Commission and a health portal run by the Australian government were among them. The Australian prime minister criticised OpenAI for informing his government too late. The review will take months yet, OpenAI writes. As far as is known, the 53 images are the first case in this series in which data belonging to ChatGPT users is affected.

Who answers for an AI agent

The case reveals a peculiarity of AI agents. An agent told to pass on a file takes whatever route works, if necessary via a third-party image site. Whether it is thereby carrying data out of the building does not feature in its task. That changes nothing about responsibility. Whoever operates an agent answers for its actions, just as a company answers for its software or its employees. Nor does OpenAI shift the responsibility onto the technology; it speaks of an inappropriate use of the data and of safeguards that came too late.

Second point: consent. Anyone who does not switch training off allows OpenAI to use their content to improve the models. Uploading it to a third-party image site is a different purpose, and permission covers only the purpose for which it was given. Third point: the EU AI Act. The regulation requires providers of particularly powerful AI models to document serious incidents and report them to the European Commission. Whether this also applies to an internal research environment whose models never reached the market is legally unresolved. OpenAI itself writes that the criteria for disclosing such incidents are still developing across the industry. That is honest, and it describes a gap that extends far beyond OpenAI.