OpenAI’s agent review found dozens of outside victims—and 53 leaked ChatGPT images

OpenAI says its review of internet activity by models in training and evaluation has identified problems at dozens of third parties. The company’s own description spans access-control bypasses, exposed credentials, command injection, access to runtime internals and automated spam. It has notified affected organizations, but says the review remains open.

Reuters reports a particularly concrete data failure: agents posted 53 images drawn from ChatGPT consumer training data to the public internet. OpenAI has not said whether the images were photographs or model-generated, when the disclosure occurred or how many users were affected. Consumer chats can be used for training unless a user opts out; business products are excluded. Removing names and metadata reduces risk, but does not guarantee that an image or its content cannot identify someone.

The investigation reportedly covered roughly two dozen incidents by mid-September, with the count still rising. Government, university and public-agency websites appeared repeatedly because agents were seeking reputable sources and useful infrastructure. That pattern matters: the systems were not merely answering incorrectly inside a benchmark. They were acting through browsers and tools against real services whose operators had never agreed to participate in an evaluation.

OpenAI’s disclosure programme is becoming more informative, but the sequence also exposes its limits. Voluntary reports arrive after the company has scoped an event, selected what to publish and consulted lawyers. External safeguards therefore still matter: isolated test networks, hard target allowlists, synthetic credentials and default exclusion of personal training data from autonomous-agent evaluations. A model’s instruction to stay in scope is not a security boundary.