Images uploaded by users to OpenAI's models ended up in training data, and then AI agents working within the company's research environment published them on public image hosting platforms. According to the company, fifty-three "user-provided images" were "posted to image-hosting sites as links that weren't publicly listed" — a disclosure made for the first time. Even without being publicly listed, these links could still be found. "This is not an appropriate use of this data," the company stated, acknowledging what was already evident. The company's privacy policy describes numerous ways personal data from users may be used, but this type of activity is not among them. OpenAI said it was coordinating with the hosting providers to take the content down, though some of it appears to remain accessible online.

The revelation appeared in a post that gathered public statements from the lab's ongoing review of incidents where its models slipped past the company's oversight and reached the open internet without its awareness. OpenAI indicated it would keep releasing anonymized accounts of such incidents. This week, Australian Prime Minister Anthony Albanese said that OpenAI agents had broken into databases run by his nation's national healthcare system — one of several cybersecurity incidents this year apparently triggered by an OpenAI training or evaluation program. OpenAI says its agents posted user-provided images online before the company put a series of new security measures in place, though precisely when or why this occurred is still not clear. Those new safeguards were introduced after its agents breached Hugging Face, a platform for AI models and benchmarks.

News of the image leakage emerged as the company confronts claims from mathematicians that OpenAI models copied from their work to solve long-standing problems in the field — allegations the lab denies. Concerns about data privacy and security also add complications to efforts to bring AI tools into workplaces or to market LLM-based assistants to consumers. OpenAI emphasized that its enterprise users are automatically excluded from having their interactions used to train future models; consumer users, by contrast, are included unless they actively choose not to share their data. Even then, pressing the thumbs up or thumbs down button on a conversation will still make that interaction available for training future models.