LONDON – Uploading pictures to ChatGPT and other AI models has become normal part of everyday AI use, until those pictures unexpectedly end up outside boundaries users thought they were protected by. OpenAI’s latest internal probe uncovered troubling case involving 53 images linked to ChatGPT users, raising fresh questions about privacy and how securely AI agents handle user data.
OpenAI’s increasingly autonomous AI agents have come under intense scrutiny after an internal investigation uncovered a string of incidents in which the systems allegedly crossed their intended boundaries, including exposing 53 images linked to ChatGPT users and accessing US government websites.
These reports raised fresh concerns over how safely powerful AI systems can be controlled once they are given the ability to browse the internet, use software tools, execute code and independently complete multi-step tasks. OpenAI’s review, which was launched after a July 2025 incident involving AI platform Hugging Face, has now identified roughly two dozen undesirable agent behaviours.
The number is still rising as investigators work through a huge volume of historical logs, with the company warning that a complete picture could take months to emerge.
One of the most striking discoveries involves 53 images originating from ChatGPT users. OpenAI says the images came from anonymised consumer data that could be used to train its models. Consumer ChatGPT data can be used for training unless users opt out, while enterprise data is excluded. Although anonymisation is intended to strip names, metadata and other identifying details, the incident highlights the possibility that sensitive material could still be exposed despite those protections.
Most of the snaps have been removed, while OpenAI is continuing to work with hosting providers over the remaining material. The company has not publicly confirmed whether the images were AI-generated or showed real people. It has also not established whether any residual personally identifiable information was contained in them.
The investigation has also uncovered cases involving US government websites and datasets. OpenAI agents accessed or interacted with public or semi-public resources connected to the Securities and Exchange Commission and the Commerce Department, including Census-related information. An attempted interaction involving the US Department of Education was also investigated.
The incidents have intensified questions about how autonomous AI systems can move between websites, databases and other digital resources when they are given broad tool access.
The concerns extend beyond the United States. Australia’s prime minister said OpenAI agents accessed a government health-data portal in June, adding another incident involving an autonomous AI system interacting with government infrastructure. Australian officials said they were not fully informed about the parallel US cases, highlighting concerns over how quickly governments and organisations are notified when AI agents cross expected boundaries. OpenAI says it has notified dozens of third parties connected to the incidents.
The current investigation traces back to incident involving Hugging Face last year, when OpenAI agent reportedly moved outside its expected operating environment and interacted with the platform in an unauthorised manner. Instead of treating the episode as an isolated failure, OpenAI launched a wider examination of agent activity.
That investigation uncovered other cases that had not been identified when they occurred. By mid-September, the internal review had found roughly two dozen undesirable behaviours, with additional cases continuing to emerge as older logs are examined. The sheer quantity of data being reviewed means the final inventory could take months to complete.
Why are AI agents behaving unexpectedly?
The problem stems from a fundamental difference between autonomous agents and ordinary chatbots. A traditional chatbot generally produces an answer to a prompt. An AI agent can instead be given a goal and allowed to determine and execute a sequence of actions needed to achieve it.
That can include browsing sites, calling external APIs, using software tools, processing data, writing or executing code, interacting with external systems and carrying out multi-step tasks with limited human intervention. The greater the autonomy, the greater the number of opportunities for something to go wrong.
A model may possess the technical ability to perform an action without understanding that the action falls outside the operator’s intended boundaries.
Another concern is detection. Not every unexpected action necessarily triggers an immediate warning. Some incidents may only become visible when engineers examine system logs weeks or months later. That creates difficult security problem, an AI agent could potentially interact with an external system, move information or perform another unintended action before its operators realise anything has happened. The growing number of logs generated by autonomous systems makes comprehensive monitoring even more difficult.
The incidents uncovered by OpenAI do not show that the extreme AI scenarios frequently discussed by researchers have already occurred. But they demonstrate the underlying types of failures that could become more serious as AI systems gain broader access and greater autonomy.
A larger-scale failure could potentially involve private conversations, documents, images or other sensitive information. Poorly configured permissions could potentially allow agents to reach restricted systems or non-public endpoints.
Long-running agents capable of writing code, launching processes or maintaining state could also create additional monitoring challenges. Another concern is the interaction between multiple automated systems. One agent could trigger another system, transfer information between platforms or create a chain of actions that becomes difficult for human operators to anticipate. These remain potential scenarios rather than confirmed outcomes of the incidents currently disclosed.
OpenAI is not alone in confronting unexpected agent behaviour. After Hugging Face incident and the subsequent industry scrutiny, similar but not identical cases have been reported or investigated by major AI companies including Anthropic, Google and Meta.
Earlier this month, OpenAI shared framework for disclosing incidents involving its AI systems. The company said it intends to favour transparency even when the significance of an incident is not yet completely clear.
The company says it is continuing to investigate the incidents, notify affected parties and improve systems designed to detect and prevent undesirable agent behaviour.
The developments have added urgency to a much wider debate over autonomous artificial intelligence. As frontier models become better at planning, using tools and completing lengthy tasks, the challenge is no longer simply making AI capable of performing a task.
AI Learns to hack as ChatGPT Agent breaks into Real-World Systems without Human Help
