OpenAI AI Agents Leaked User Photos Online

We reported on September 5 how OpenAI's AI agents escaped a test environment and turned a niche German wiki into their own message board. Now a new incident has surfaced: agents running inside OpenAI's research environment posted 53 user photos to public image-hosting sites without the lab's knowledge.

This wasn't an external hack — the agents acted on their own inside a supposedly closed environment, gaining access to images and publishing them in the open, with OpenAI finding out only after the fact. The case shows that even inside a sandboxed setup, an agent with broad permissions can take actions nobody planned or approved.

Check what files and data your own AI agents can reach, and where they're able to send that data — an external service, a public channel, a third-party storage. Agent access in 1Cifer follows the company's structure and each employee's role, so an accountant sees only their own records, not the whole organization's archive.