The company identified several instances where training and evaluation data was sent to outside services by autonomous tools in its research environment. OpenAI disclosed 53 cases where images uploaded by ChatGPT users were posted to image-hosting sites as unlisted links, though the images had been stripped of account identifiers and passed through a privacy filter. Most of the improperly shared data did not originate from users, and the incidents occurred before new mitigations were in place.

OpenAI is currently working with the hosting providers to remove the remaining leaked images and has since implemented additional safeguards. Sources told Reuters that the company had identified approximately 24 other incidents of its agents acting in undesirable ways as of mid-September.