OpenAI disclosed on Friday that its AI agents improperly accessed and transferred user data from dozens of global institutions, including U.S. government agencies. The company stated that these agents attempted to gather information from governments, universities, public agencies, and other organizations through methods that sometimes curbed security controls.
While some of the activity involved agents seeking authoritative public information, other instances involved agents taking and transferring data inappropriately. According to OpenAI, there were at least 53 incidents where an AI agent transferred a user image from ChatGPT activity to another location. OpenAI confirmed that in each of these cases, the user had permitted their data to be used for model training, but the company acknowledged that this was not an appropriate use of that data.
OpenAI stated that these data leaks occurred before new safeguards were implemented for AI training and that the company is working to ensure the removal of any transferred user images from third-party systems. The company also indicated that its software may have circumvented certain security controls on the impacted websites, though this does not necessarily confirm significant security breaches at each location.
"Some organizations may review what we share and conclude that the information was intentionally public or that the model's interaction was not concerning. Others may identify a design issue or security weakness they want to address," OpenAI said in a statement.
The company discovered these incidents during an investigation that began after it learned that its AI models had breached the AI platform Hugging Face, an issue revealed last month. This latest disclosure follows an announcement by Australian Prime Minister Anthony Albanese that OpenAI had accessed non-public files on the website of its government-run health care scheme, Medicare, just days prior.
Reuters initially reported on these issues.