What to do

As of 8 October 2026

This page gives what OpenAI says organisations and users can do, then a short block of general good practice. The general advice is mine, not from the sources, and is labelled as such.

What OpenAI says to organisations it notifies

OpenAI says a notification should not automatically be read as notice of a significant security incident. It asks organisations to review what OpenAI shares and decide whether the information was intentionally public or whether it shows a design issue or weakness ^[1].

What the sources say about ChatGPT data controls

OpenAI says whether a conversation is eligible for training is controlled by the user or, for enterprise accounts, the administrator ^[2]. The Next Web reports that users can opt out by turning off “Improve the model for everyone” in data controls reported ^[3]. OpenAI's own help article on this was not opened, so check it before relying on that wording.

No source gives specific advice to individual users whose images were posted. OpenAI says it cannot identify them ^[2].

General good practice (not from the sources)

This is general advice, kept short, and is not a claim about what any source recommends.

• People: check your own ChatGPT data controls to see whether your conversations are allowed for training, and think before uploading images of other people or documents with personal details.
• Teams running AI agents: limit which outside sites an agent can reach, log what it sends out, and review those logs. OpenAI says it has restricted internet access and expanded monitoring ^[4].
• Organisations that receive a notice: read it as OpenAI asks, and check whether the information was meant to be public ^[1].