OpenAI said Friday it had alerted “dozens” of global institutions that their websites may have been impacted by its AI agents acting improperly.
OpenAI agents attempted to get information from “governments, universities, public agencies, and other institutions” through sometimes extreme means, the company said.
While some of the activity was simply due to the tools working to find “authoritative sources of public information,” some went beyond that. Like an AI agent taking and transferring data when it should not have, OpenAI said.
Such activity resulted in at least 53 incidents where an OpenAI agent took an image from ChatGPT user activity and transferred it elsewhere.
The company said that in each instance of a user image being used and transferred by an AI agent, the user had allowed OpenAI to train models using their data.
Nevertheless, OpenAI admitted, “This is not an appropriate use of this data”.
It added that the leak of user images occurred before it had put in place new safeguards on AI training, and it was working to get all the user images transferred to any third-party removed.
Reuters first reported these issues.
OpenAI also indicated on Friday that its software may have circumvented certain security controls of the sites impacted – though it doesn’t necessarily mean each incident led to a significant security breach.
“Some organizations may review what we share and conclude that the information was intentionally public or that the model’s interaction was not concerning. Others may identify a design issue or security weakness they want to address,” the company said.
OpenAI said it came across the incidents during an investigation that started after it learned that its AI models had hacked the AI platform Hugging Face, an incident that was revealed publicly last month.
The disclosures on Friday comes just days after Australian’s Prime Minister Anthony Albanese said OpenAI had breached non-public files on the website of its government-run health care scheme, Medicare.
