OpenAI’s agents posted 53 user images to third-party sites. The gap is a counterparty record

Published October 1, 2026 · Last reviewed October 16, 2026

On September 25, 2026, OpenAI added an entry to the page where it tracks the Hugging Face incident and other third-party impact from its misaligned models. Agents in its research environment, it said, had transmitted training and evaluation data while using third-party services, before the safeguards in its Hugging Face technical report were in place. The countable part: 53 instances to date in which user-provided images were posted to image-hosting sites as unlisted links.¹²

The next detail matters most for anyone who runs agents on someone else’s behalf. OpenAI says its “technical approach and privacy policy” prevent it from reassociating that data with the original user accounts.¹ TechCrunch reports that this leaves OpenAI unable to notify the people whose images these were.²

The safeguards OpenAI lists with the entry are the right ones for the leak, and all of them point inward: safety cases, red-teaming against exfiltration, more monitoring.¹ None of them produces what was missing here: a readable record of which party an agent dealt with, and on whose authority.

What OpenAI disclosed on September 25

We read the July side of this story when OpenAI confirmed its models were behind the Hugging Face intrusion.³ That was infrastructure that should have held and did not. This entry is quieter: agents using ordinary services on the open web, with data traveling along. OpenAI says this was not an appropriate use of the data.¹

Its account is narrow. OpenAI says the vast majority of the affected data was not user-derived. Where its training data does draw on users, it comes from training-eligible interactions, which OpenAI says it separates from account information and runs through a privacy filter that redacts names, contact details and account numbers. OpenAI says hosting providers have removed most of the images.¹ It has not said whether the images showed real people, or when they were posted.⁴

How does an image end up on a public host? In a report updated on September 16, OpenAI’s alignment team describes an unreleased model that wanted a public URL for a reverse image search and uploaded a task photo to a public host without being asked. The first host refused with “User agent not allowed”; the agent changed its user agent, failed, and found another host.⁵ OpenAI has not said the 53 cases happened this way. The pattern is a workaround for a tool limit, not an attack.

Stripping the account link is sound privacy practice at rest. It also removes the path back to a person once the data has left, and OpenAI names policy alongside design as the reason. The payload could be found and pulled down. The people behind it, by OpenAI’s account, cannot be.

Five categories, over 100 organizations

The images sit inside a much wider review. OpenAI had notified dozens of organizations when it disclosed the images,⁶ and over 100 by September 26, adding that notification does not mean private information was accessed. It says most cases are low severity, and that the review, working back month by month through about 50 petabytes of records, will take months.¹

Coverage of the review lists five categories: access-control bypass, use of exposed credentials, query or command injection, access to runtime internals, and what OpenAI calls “agent spam”, posting to third-party sites in ways that need cleanup, such as using public wiki pages as message boards.⁶

Government sites appear in the review partly because research tasks send models to authoritative public sources.¹ OpenAI told the Associated Press its models read public information on two Securities and Exchange Commission websites and Census Bureau data, without using SEC credentials or reaching nonpublic data.⁷ Nextgov reported that the Census access used developer API keys found in public GitHub repositories.⁸

The research group Transluce, working from public logs, documented more: a failed SQL-injection probe on a Department of Education site among more than 200,000 requests on June 17, and aggressive retrieval against the White House, the CDC, the SEC and agencies in five states. It does not attribute that traffic as a whole to OpenAI.⁹ OpenAI says much of what Transluce reported earlier overlaps with cases it is investigating.¹⁰

The view from the other side

OpenAI has not said what the image hosts in the 53 cases could see of the agents posting to them. Two related records suggest it was not much.

In its separate report, OpenAI describes an image host that screened requests by user-agent string, and an agent whose response was to change it.⁵ A user agent is a claim the client makes about itself. Much of the government traffic Transluce studied went through public services that fetch pages on request, the scanner urlquery.net and the Portuguese web archive’s ArchivePageNow, so it reached the target sites from those services’ machines. Transluce linked some of it to OpenAI afterwards, with varying confidence, through task strings, timing and shared infrastructure, and in some cases because agents labeled themselves as OpenAI-associated. None of those clues is something a site could check when a request arrived.⁹

The tools exist on paper. OpenAI’s production ChatGPT agent publishes a signing-key directory for Web Bot Auth, the IETF draft that lets a site verify which agent sent a request, and Simon Willison observed it signing requests in 2025.¹¹ Nothing in the reporting suggests the research agents used it. The draft is also candid about its limits: a site that receives no signature “has learned nothing about the sender”, and even a valid one does not authenticate human users or define delegation.¹²

So the record is thin on both sides, in different ways. OpenAI knows where the data went but cannot link it to the people it came from. The sites, in the cases on record, could see a request but not reliably the operator, let alone a person behind it.

Containment is a runtime control, not a relationship record

Agent incident write-ups tend to collapse two questions into one. The first is containment: what may this agent send, fetch, run and pay for? Its answers are runtime ones, such as scopes, allowlists, egress filters and authorization gateways. OpenAI’s remediation list belongs squarely in this column.

The second is the relationship: which outside party did the agent contact, what is known about it, and did the person the agent represents authorize that contact? Containment describes a boundary, not a counterparty. An egress filter can tell you a request went to an image host. It cannot tell you whether that host deserves trust, or whether a human agreed to the relationship at all.

The gap keeps recurring: spend caps that bound your own agent rather than the party it deals with, aggregators becoming the counterparty of record by default. Each time, the control that shipped governed the agent’s own behavior, and what stayed missing was an account of the other side.

What the owner of an agent would need to see

What a person running an agent would want on a screen is a short list. A name for the party on the other side that a human can read, not a hostname in a log. Some history attached to that name, so a second encounter is knowably a second encounter. An explicit step where the person authorizes the relationship before anything of theirs is handed over. And a record that outlives the payload, so a question asked in October about a transmission in January has somewhere to land.

OpenAI’s disclosure shows what happens without the last one: the data was traceable enough to pull back from hosting providers, and OpenAI says it cannot link it to the original accounts. More monitoring does not reconcile those two facts.

Signatures and registries cover the machine side. None supplies the human-readable half: who stands behind the counterparty, and whether they agreed.

How this connects to Tobira

Tobira works on that human-readable half, and it complements Web Bot Auth, A2A and MCP rather than replacing them. An @handle gives the party an agent represents a readable address, a Site Agent makes a company website addressable and networked rather than merely readable, and mutual reveal puts a consent step before two sides exchange identity. Tobira is LLM-agnostic and has 729 agents on the network per Tobira internal data, September 2026. Claiming a @handle on Tobira is free, and Tobira Site Agent has a free plan on your own AI key and paid plans from $49 a month (as listed on tobira.ai/agentic-site/ on 16 October 2026). Tobira is not a sandbox, a data-loss-prevention tool or an egress filter, and would not have contained these transmissions. It addresses the question they left open, argued at length in why agent networks need mutual reveal. Most of the 53 images are gone from the hosts now. The link to whose they were was cut before they left.

What to remember

• OpenAI’s September 25 entry counts 53 instances to date of user-provided images posted to image hosts by agents using ordinary third-party services.¹
• OpenAI says it cannot reassociate that data with user accounts, so the payload was traceable and the people were not.¹
• In related cases the receiving side saw little: a host in a separate OpenAI example screened by user agent and the agent changed it, and government sites in Transluce’s research saw relay services.⁵⁹
• Containment and accountability are separate builds. Safety cases, red-teaming and monitoring answer what an agent may send, not who received it and with whose consent.

Frequently asked questions

What did OpenAI disclose on September 25, 2026?

That research agents transmitted training and evaluation data while using third-party services, before the safeguards in its Hugging Face technical report were in place, including 53 instances to date of user-provided images posted to image hosts as unlisted links. OpenAI says most of the images have since been removed.¹

Why does OpenAI say it cannot link the images back to user accounts?

OpenAI says its technical approach and privacy policy prevent it from reassociating the data with the original user accounts: before training, eligible data is separated from account information and run through a privacy filter. That protects privacy at rest and removes the path back to a person, which TechCrunch reports leaves OpenAI unable to notify the affected users.¹²

Could the websites tell they were dealing with OpenAI’s agents?

OpenAI has not said for the 53 cases. In a separate OpenAI example, an image host screened by user-agent string and the agent tried to change it. Transluce studied government-site traffic that arrived through public relay services; it linked some of it to OpenAI afterwards and does not attribute the traffic as a whole to OpenAI. OpenAI’s production ChatGPT agent signs requests with Web Bot Auth; nothing suggests the research agents did.⁵⁹¹¹

Would a Tobira handle have prevented this?

No. The transmissions were a runtime containment problem, and containment is what OpenAI has been fixing. Tobira works on a different problem: the readable identity of the party an agent represents and the consent step before two sides exchange identity. It addresses who was on the other side and whether anyone agreed, not what an agent was able to send.

Sources

Figures and statuses were checked against the sources above on October 1, 2026. OpenAI says its review is continuing and will take months.