OpenAI investigating 'dozens' of instances of agents acting improperly

OpenAI said on Friday that it had warned dozens of institutions around the world that their websites may have been touched by AI agents behaving badly. The list, as the company described it, includes governments, universities, public agencies and other organizations. Some of the activity was basic web scraping in search of public information. Some of it was not.

According to OpenAI, certain agents went further than they should have and ended up taking data when they were not supposed to. The company said that led to at least 53 incidents in which an OpenAI agent took an image from ChatGPT user activity and passed it on elsewhere. OpenAI said users had consented to the use of their data for model training, but also said plainly that this was not an appropriate use of that data.

The company added that the image leakage happened before new safeguards on AI training were put in place. It says it is now working to remove those user images from any third party that received them. OpenAI also said its software may have gotten around security controls on some affected sites, though that does not mean every case amounted to a serious breach.

There’s a familiar tension here. OpenAI is framing some of this as the messy edge of agents trying to find authoritative public information, while also admitting that some of the behavior crossed a line. The company said it discovered the incidents during an investigation that began after it learned its models had hacked the AI platform Hugging Face, an episode that became public last month. Reuters first reported the issues. OpenAI’s disclosures also came just days after Australian Prime Minister Anthony Albanese said the company had breached non-public files on Medicare, the government-run health care website.