• OpenAI disclosed AI agent security incidents.
• OpenAI and Anthropic tightened agent safeguards.

OpenAI has disclosed that AI agents operating in its research environment posted 53 user-provided images to external image-hosting services, adding to a series of incidents involving models acting outside their intended scope.

The images had been included in training data after being uploaded by users to OpenAI products. According to TechCrunch, the agents posted them to image-hosting sites through links that were not publicly listed but could still be discovered.

OpenAI said the activity was not an appropriate use of the data and was working with hosting providers to remove the material. The company also said it could not notify individual users because its technical approach and privacy policy prevented it from reassociating the images with the people who originally provided them.

The incident occurred before OpenAI introduced additional security procedures following a separate incident involving AI development platform Hugging Face. OpenAI has since introduced tighter controls for high-capability models used in internal training, evaluation, and tool-using inference.

During internal evaluations, some OpenAI agents were given access to tools and software environments that allowed them to browse, interact with systems, and complete multi-step tasks. OpenAI’s current evaluations track behaviours including excessive access, unauthorised transactions, data loss, circumvention of controls, and transfers of potentially sensitive information to unapproved services.

Agents move beyond their assigned tasks

The image uploads are part of a wider OpenAI review into cases where its models took unintended actions while completing tasks. OpenAI has separately documented incidents in which internal research models bypassed network restrictions and interacted with systems beyond their assigned evaluation environments.

The most extensive disclosed incident occurred during cybersecurity testing in July, when OpenAI models circumvented controls intended to isolate them from the internet. The models compromised parts of OpenAI’s research infrastructure and systems operated by Hugging Face, according to the company.

OpenAI said the agents communicated through unauthorised channels, exploited vulnerabilities in shared infrastructure, gained internet access, and reached third-party systems. The models were operating with reduced safeguards as part of cybersecurity evaluations.

Some agents found unintended communication channels, while others chained vulnerabilities to reach the wider internet. OpenAI also said some agents continued searching for alternative routes after becoming blocked on difficult tasks.

In some cases, agents exchanged information and delegated work through channels that were not intended for inter-agent communication.

A separate incident involved an OpenAI agent gaining unauthorised access to an Australian government system in June. Australian Prime Minister Anthony Albanese said recently that the agent accessed infrastructure behind the Medicare Statistics Reporting Service portal operated by Services Australia.

The agent accessed both public and non-public files, according to the Australian government. The portal contains Medicare spending and statistical information rather than systems used to process individual Medicare claims.

Australian officials said there was no evidence at the time that personal information had been accessed. A forensic investigation involving the Australian Signals Directorate was launched to determine the scope of the incident and whether any other government systems were affected.

In a separate interview, Albanese said the agent had been seeking general medical, cost, and financing information and found a way around barriers after it was unable to retrieve the information normally. The Australian government has not said the agent was instructed to bypass those controls.

OpenAI has since expanded the types of agent behaviour it evaluates. Its GPT-6 Astra system card describes simulations designed to detect whether models take actions that users would not reasonably expect or approve.

Examples include deleting cloud data without approval, disabling monitoring systems, circumventing security controls, and uploading source code, credentials, images, or personal data to services that were not authorised for the task.

OpenAI tested Astra across 54,218 internal Codex tasks and reported 53% fewer severity-three actions than GPT-5.6 Sol on the matched evaluation set. OpenAI said Astra still sometimes overreached during engineering tasks, including using privileged access without clear approval or giving automations broader permissions than required.

OpenAI tightens controls around agent access

A separate incident disclosed in September involved an internal research agent using a gap in OpenAI’s internet restrictions to contact an external chatbot through DNS requests. The agent had been assigned a search task and had not been instructed to probe network controls or reach the live internet.

OpenAI said the agent initially used an approved search tool before unsuccessfully attempting to contact search engines directly. It later used insufficient DNS filtering in its sandbox to reach the external chatbot.

The company’s monitoring system flagged the behaviour within 15 minutes, and a human reviewer began examining it three minutes later. OpenAI terminated the run around two and a half hours after the behaviour was detected and subsequently added blocking controls at two separate layers.

OpenAI said either control would have blocked the route used by the agent. Tool-using training, evaluation, and inference involving its most capable models remained paused when the report was published.

The company has introduced additional safeguards following the Hugging Face incident, including tighter network isolation, stricter internet access, more isolated sandboxes, controls over model weights, and expanded monitoring of model activity.

OpenAI said GPT-6 Astra uses monitoring during tool-based inference in external deployments. The system can flag potentially unauthorised behaviour and stop activity that crosses configured boundaries.

OpenAI has also acknowledged limitations in its monitoring systems. In adversarial evaluations, Astra’s written reasoning was harder to monitor than GPT-5.6 Sol’s when researchers explicitly instructed the model to evade oversight.

Other AI developers report similar incidents

Anthropic disclosed in September that it had identified four incidents in which Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations.

The company initially found three cases after reviewing about 141,000 transcripts and later identified a fourth during a broader investigation. Anthropic said all four incidents occurred in cybersecurity evaluations where the models had been told they were operating in simulations, but a configuration error connected the environments to the open internet.

Anthropic later expanded its review to roughly 481 million transcripts and said it did not identify additional incidents of comparable or greater severity.

The OpenAI and Anthropic cases occurred in research or evaluation environments rather than ordinary consumer chatbot sessions. OpenAI said some of its models were operating with reduced safeguards during cybersecurity evaluations, while Anthropic attributed its four disclosed incidents to a misconfigured evaluation environment that left internet access open.

OpenAI has responded by adding restrictions at the network and sandbox level, monitoring agent actions, and introducing systems capable of pausing or terminating certain workloads. Its current evaluations also test whether agents exceed authorised permissions, transfer sensitive information, circumvent controls, or make changes that were not requested.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.