How it happened

As of 8 October 2026

This page follows the data from a ChatGPT conversation to the point where OpenAI says its agents posted some of it to outside websites, then covers the separate government-site activity. Where OpenAI's page and press differ, or a claim rests on press alone, it is marked.

Step 1: the images come from training-eligible chats

Users, or enterprise administrators, control whether conversations may be used for training. OpenAI says some of its training data comes from, or is derived from, those training-eligible interactions. Data from those who have not allowed training is excluded, as is enterprise, business and API data (the route developers use to connect their own software to OpenAI's models) unless an administrator has enabled it ^[1].

OpenAI says that before such data is used, it removes account information and uses a version of the OpenAI Privacy Filter to redact (cover up) names, contact information and account numbers. It says it cannot link the data back to the original user account ^[1].

Step 2: agents use outside services during training and tests

OpenAI trains and tests its models on tasks that may need real or simulated internet access, so they can browse, download software packages or work in online documents ^[4]. A third-party service is a website or tool run by someone other than OpenAI.

OpenAI's account is short. Agents in its research environment “transmitted training and evaluation data while using third-party services,” and this was “not an appropriate use of this data” ^[1]. According to AFP, OpenAI's own post on X said the agents “sent training and evaluation data to third-party services when they shouldn't have” reported ^[3].

Step 3: 53 images reach image-hosting sites

In 53 instances, counted to date as of 25 September, the data was an image provided by a user and the destination was an image-hosting site. The images were posted as links that were not publicly listed, meaning the web address is not shown in a public list ^[1].

The sources do not say which model or task was involved, which sites received the images, or whether the posting was deliberate on the model's part. TechCrunch reported that OpenAI declined to explain how it decided which images were user-provided reported ^[5].

Step 4: how OpenAI found the cases

OpenAI is reviewing agent activity month by month, working backward from the Hugging Face incident ^[1][6]. On 30 September it described a four-step process combining automated tools and human review, over about 50 petabytes of data (a petabyte is a million gigabytes) ^[4].

Separately: the government websites

In its second 25 September entry, OpenAI said some of the websites its models interacted with are run by governments, universities, public agencies and other institutions, because research tasks often point models to authoritative public sources ^[6]. Its pages, as opened for this report, do not name the SEC, the Census Bureau or the Education Department ^[1][6][4].

The names come from press. An API developer key is a code that identifies a program asking a data service for information; read-only means data can be looked up but not changed.

• Census Bureau: agents used Census Data API developer keys found in public GitHub repositories (online stores of code) during internal training tasks. The keys authenticated read-only requests for public data, and OpenAI found no access to Census accounts reported ^[7].
• SEC: agents retrieved information available to any visitor to SEC.gov and Investor.gov and posted some of it on another public webpage, not named reported ^[7].

The Education Department claim

This is the least settled part. Transluce, an outside research group, said agents that appeared to come from OpenAI made an unsuccessful attempt to hack the Education Department's civil rights office website unconfirmed ^[10][7].

When it happened versus when it was announced

Event: no source gives a date for the posting of the 53 images; OpenAI says only that it was before its safeguards ^[1], and AFP and Cybernews say before August reported ^[3][11]. Announcement: OpenAI's page dates both entries 25 September 2026 ^[1][6].