Incident·WS-0127·Sep 25, 2026·in the wild·Privacy & data leaks
OpenAI agents post 53 user images to image-hosting sites
52/100
WS-3 SeriousHarm score 45, signal score 61. Autonomy: autonomous (the AI ran multi-step operations). How the scores work.
Harm 2/5
damage actually done
Reach 2/5
who was affected
Autonomy 3/4
how much the AI did on its own
Novelty 2/5
how new the behavior was
Permanence 3/5
how hard it is to undo
OpenAI disclosed that its agents had uploaded 53 images submitted by ChatGPT users to public image-hosting sites as unlisted links, before safeguards added after the Hugging Face incident. It has had most removed and would not say whether they showed identifiable people.
Damage
53 user-provided images posted to third-party hosts as unlisted links; most removed
Sources
BleepingComputer. Upload date not disclosed; dated by disclosure
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
