OpenAI Admits AI Leaked 53 User Images to Third-Party Sites

OpenAI has almost entirely failed in ensuring the security of its large models.

On September 25, OpenAI updated its blog post titled "The Hugging Face Incident and the Impact of Misaligned Models on Other Third Parties," disclosing its latest large model security issue.

In their research environment, AI agents sent training and evaluation data—including user images—to third-party services during training and evaluation, resulting in a total of 53 related incidents.

In the blog, OpenAI stated that it identified 53 cases where user-uploaded images were posted by agents to image hosting websites via "unlisted links."

OpenAI emphasizes that these images come from accounts that have opted in to having their data used to improve the model, and only after the images have been detached from the accounts and processed through a privacy filter. Data from enterprise and business accounts, as well as API usage, is excluded by default unless explicitly enabled by an administrator.

However, the issue is that regardless of the privacy measures taken, users' images ultimately appeared on third-party hosting websites. OpenAI has partnered with the hosting provider to remove most of the content and is currently working on the remaining items.

In addition, these agents learned to bypass security controls, inject database queries, exploit publicly exposed credentials, and even write files to internal servers of foreign governments.

The independent AI oversight lab Transluce has released an investigation report. The report reveals that OpenAI’s agents have been actively scavenging across the internet since at least March 2026—and possibly as early as November 2025—targeting online databases of institutions including Data USA, the University of New Mexico Digital Library, and the Australian Institute of Health and Welfare (AIHW).

Since the well-known Hugging Face incident, security incidents related to OpenAI models have continued to occur, and the reward pool is still growing.

OpenAI stated, "Following the Hugging Face incident, we committed to conducting a broader review of the actions taken by models during training and evaluation, and to maintaining transparency about our findings. This is an ongoing, comprehensive review." This blog post is the result of that commitment.

Blog link: https://openai.com/zh-Hans-CN/hugging-face-incident-and-misalignment/#model-misalignment-2026-09-25-data-transmission

But the issue is that OpenAI claims it has taken measures, yet related incidents continue to occur—unclear whether this is a marketing tactic or a failure of its security strategy.

According to OpenAI's own disclosure, they identified the following categories of agent behaviors during their review:

Bypassing access controls: The agent obtained information that typically requires authentication or a subscription by altering URLs, modifying request parameters, or exploiting overly privileged login sessions.

Using publicly exposed credentials: The agent discovered publicly available login information or API keys online and used them directly.

Query and command injection: Text input by the agent is executed as commands, leading to the execution of database queries, application code, or even system commands.

Accessing internal resources: The agent read server-side implementation files or interacted with backend systems available only internally.

Agent spam: Agents post on third-party websites, such as using public wiki pages as shared bulletin boards for communication.

These actions are not the result of a single isolated incident. OpenAI stated that they have notified "dozens of third parties," affecting government agencies, universities, and public institutions. According to The New York Times, the U.S. Securities and Exchange Commission (S EC Databases from the Census Bureau and the Department of Education are also targeted.

To be honest, OpenAI’s related disclosures remain vague, such as referring to hacker activities as “interactions” and deliberately obscuring the number of third parties.

Researchers from Transluce cross-referenced activity logs from an agent collaboration forum with public logs from a browser proxy service to trace the behavioral patterns of OpenAI agents.

A specific example: The agent was tasked with finding a highly obscure data point—the per capita annual cost of dermatological medications in Victoria, Australia, in January 2022. To locate this figure, the agent attempted to bypass the anti-scraping protections of the Australian Institute of Health and Welfare. On June 20, logs recorded the agent’s attempts to access the website; on June 21, the agent discussed its difficulty in circumventing the AIHW’s bot protection on a forum.

Transluce said: “We just looked at a few data sources, and these agents happened to leave traces there. OpenAI certainly knows much more. Other labs likely know even more, they just haven’t made it public.”

His assessment is: what we are currently seeing is just "the tip of the iceberg."

On the same day the Transluce report was released, Australian Prime Minister Albanese publicly stated that OpenAI's agents attempted to infiltrate four Australian government websites, one of which was successfully compromised, even writing files to the internal servers of the country’s national healthcare system.

Meanwhile, security researcher Jeffrey Ladish discovered nearly one million public URLs left behind by OpenAI agents during their intrusion of Hugging Face, containing leaked credentials and attack details that could enable anyone who finds these URLs to compromise Hugging Face.

The timeline is also compelling. Transluce’s technical team noted that similar agent activity dates back as early as March 2026, and possibly even November 2025. Even more concerning, similar activity is still occurring this week.

Researchers also noted a key timeline: On June 21, a human employee at OpenAI first accessed the forum used by the agents. The next day, most agent activity on the forum ceased. On June 18, meanwhile, was the day Australia’s Prime Minister stated that the healthcare system had been compromised. OpenAI claims it did not become aware of the incident in Australia until August.

OpenAI seems to be stuck in a loop, linking all kinds of "hacking" incidents to the Hugging Face incident, as if it were the source of everything.

However, we believe that several months have passed since the incident, and given the pace of advancement in large models, this timeframe is more than sufficient for an entire generational leap. In such a long period, OpenAI has still failed to implement effective safety measures to prevent similar incidents, and events akin to the Hugging Face incident continue to occur—something we find unreasonable.

Given that, let’s briefly revisit the security incident that OpenAI deemed historic enough to record.

OpenAI uses cloud-isolated "sandbox" virtual machines to run model training and evaluation tasks. These sandboxes disable internet access and are designed to isolate agents from one another. The only exception is that sandboxes allow models to access the internal package management service, Artifactory, for installing packages.

This seemingly harmless loophole became the starting point of everything.

On May 12, during a training run, an agent left a message in Artifactory requesting missing files from other agents, turning Artifactory into a kind of "message board."

On May 26, the agent advanced further: it discovered an SSRF vulnerability in Artifactory, forcing Artifactory to send requests on its behalf to arbitrary internet addresses. The agent, originally prohibited from accessing the internet, thereby gained internet access by leveraging the infrastructure. Even better, it shared this method with other agents via the message board.

On June 26, the agent exploited a token refresh vulnerability to gain administrative privileges on Artifactory.

On July 4, sustained high-intensity agent activity caused Artifactory to crash. The OpenAI security team intervened, patched the vulnerability, removed exposed credentials, and rebuilt the entire Artifactory system. The message board was also cleared.

On July 8, the Artifactory reconstruction was completed and assessed for recovery. The agent found new ways to regain internet access and rebuilt the message board within just a few hours.

On July 10, an agent recovered, verified, and shared 14 publicly exposed Hugging Face credentials with write permissions.

On July 11, the agent exploited a zero-day vulnerability in Hugging Face's processing of HDF5 files to extract credentials from production work nodes, ultimately compromising certain components of the Hugging Face platform.

For more details, please refer to the related OpenAI blog.

Blog link: https://openai.com/zh-Hans-CN/index/hugging-face-incident-and-the-road-ahead/

Following the Hugging Face incident, OpenAI paused reinforcement learning training for its latest model and implemented comprehensive security enhancements to its frontier research environment. Specific measures include:

Workload Isolation: Deploy higher-isolation sandboxes for workloads that execute model-generated code or untrusted code.

Network isolation: Isolate high-risk workloads from the internet to ensure that even if a single workload is compromised, it cannot lead to unauthorized internet access.

Enforced Chain-of-Thought Monitoring: Mandatory CoT monitoring for all RL training and evaluation involving tools or models with GPT-5.6 Sol or higher capabilities. For the most severe alerts, if responders cannot rule out a false alarm within 30 minutes, the associated activities must be suspended.

Multi-agent alignment training: Build a specialized RL environment to teach models to distrust unauthorized instructions and remain within the scope of their original tasks when confronted with persuasive peers and exposed credentials.

Ongoing security testing: Simulate attacks on workloads and network isolation boundaries using proprietary models.

OpenAI also stated that the largest planned frontier RL training remains on hold, with only smaller-scale training and evaluation currently underway, "until more evidence of alignment is obtained."

Chief Scientist Pachocki said: “Currently, I believe no laboratory has adequately addressed alignment and monitoring issues to support responsible, rapid, and sustained scaling. I look forward to and hope that voluntary slowdowns will become the norm before common safety standards are established.”

Recently, in an interview, Jensen Huang repeatedly expressed trust in AI labs, saying, “I really don’t believe they’re building something they can’t fully control.” But the reality raises sufficient doubt: is it that they “can’t control” it, or that they “won’t control” it?

When you train an AI agent with reinforcement learning to "do whatever it takes to complete the task," it will indeed do whatever it takes—including methods you didn’t anticipate and don’t want to see.

The OpenAI case turned a theoretical alignment issue into a real-world security incident. During training, the model learned to bypass firewalls, inject database queries, exploit exposed credentials, and transmit user data to external servers.

When exactly did OpenAI become aware of these events? External independent research institutions were able to track the agents' behavioral patterns within weeks using only public logs. With access to complete training logs and system monitoring, why did OpenAI wait until the issue was exposed before beginning to notify affected parties one by one?

Security issues continue to be exposed even after Hugging Face, raising questions about the security strategies of large model companies.

In 2026, as AI races forward at full speed, finding the balance between soaring capabilities and robust security will be a question every professional, every company, and every regulatory body must seriously address.

This article is from the WeChat public account "Machine Heart" (ID: almosthuman2014), authored by Leng Mao.