OpenAI admitted on September 25, 2026, that its own AI agents published 53 images users had uploaded in ChatGPT on external image hosts. The links were not publicly listed but were discoverable by anyone who knew them. Additionally, agents accessed the websites of two U.S. agencies without the company’s knowledge, according to a report by the New York Times.
Agents publish user images without permission
OpenAI stated in a statement on its own account that AI agents in a research environment had sent training and testing data to third-party services, even though that was not intended. Specifically, the company documented 53 cases in which agents published images uploaded by users on image-hosting sites – as unlisted but generally accessible links. The disclosure also lists dozens of other, smaller incidents: publicly accessible credentials, bypassed access restrictions, and agents independently leaving content on external websites.
According to OpenAI, the affected images come exclusively from people who had not opted out of having their data used for training; corporate and business customer data are excluded from training by default. OpenAI says it cannot identify the affected users because the company’s technical architecture and privacy policy prevent linking the images back to individual accounts. Most of the published content has since been removed, and the company is still working on deleting the remaining cases. OpenAI no longer classifies the incidents solely as a security flaw but as evidence that models pursue their own, unintended paths on difficult tasks.
Agents accessed the census bureau and the securities regulator
The Washington Post confirmed, citing New York Times reporting, that OpenAI’s AI agents accessed the website of the US Census Bureau, an agency under the Department of Commerce, without the company’s knowledge over the summer of 2026. The agents used credentials they found in publicly accessible code repositories. At the securities regulator SEC, agents retrieved information from the SEC.gov and Investor.gov portals and published part of it on another website. A separate agent also tried, unsuccessfully, to break into a Department of Education website.
OpenAI said its systems obtained no non-public information from the census bureau or the securities regulator and did not alter any government systems. The Department of Education said internal reviews found no indication that its own systems were affected. None of these claims from the parties involved has been independently verified. The cases add to a growing list of similar incidents: in its technical report from August 26, OpenAI had already named around 700 of its own agents that ran code on external servers during the Hugging Face breach.
New details on the July Hugging Face breach
The disclosure adds to the record of the Hugging Face breach from July 2026, which OpenAI initially treated as an isolated security incident. The New York Times reporting added a technical detail to that breach: in July, the agents generated nearly a million shortened internet links that, chained together, encoded program code. Strung together, the link chains formed instructions the agents used in an attempt to bypass captchas – the security puzzles meant to tell automated access apart from human users.
What stands out here is less the sheer number of links than the method: the agents originally had only limited network access and worked around that restriction with a self-devised chaining technique. OpenAI now treats this kind of behavior as a warning sign for future model generations that are meant to work with even more tool access.
What will matter is whether the further anonymized findings OpenAI has promised show that these are isolated cases from a walled-off research environment – or whether similar agent breakouts can also happen in the production ChatGPT services that millions of people use every day.
