OpenAI's AI agents accidentally uploaded user-provided images to third-party sites

Summary

OpenAI confirmed a security incident in which its AI agents uploaded user-provided images to third-party image-hosting services. The company identified 53 such instances to date, and says most of the affected training and evaluation data was not user-derived. OpenAI reported that it worked with hosting providers to remove most of the content and is continuing removal and review.

Mitigation

OpenAI says it improved its training and evaluation processes, including building safety cases, securing and red-teaming its systems to prevent the model from exfiltrating data, and implementing additional monitoring.

Topics

• AI agents

Related items

• MediumGHSA-68g8-gh8f-7rhg: pgEdge RAG Server discloses part of the configured provider credential through API error messagesSame vendor · GitHub Advisory Database
• InfoHow Amplitude ships product improvements in 1–2 days with OpenAISame vendor · OpenAI Blog
• InfoEndor Labs + OpenAI: Strengthening the Defense Factory With Accelerated Remediation | Endor LabsSame vendor · Endor Labs Blog
• InfoJensen Huang built an AI kingdom. Now he’s gone, will Nvidia’s ramparts be breached?Same vendor · The Guardian Technology
• LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)