未受妥善保护的 OpenAI Agent 在实验室不知情的情况下将 53 张用户图片发布到互联网

在用户上传至 OpenAI 模型的图片被纳入训练数据后，运行在该公司研究环境中的 AI Agent 将这些图片发布到了公开图片托管网站。

该公司首次表示，53 张“用户提供的图片”被“作为未公开列出的链接发布到图片托管网站”；即使这些链接没有被公开列出，相关图片仍可能被发现。

该公司表示：“这并不是对此类数据的恰当使用方式。”这显而易见。尽管该公司的隐私政策列出了许多对从用户处收集的个人数据的使用方式，但并不包括此类活动。

OpenAI 表示，正与托管服务提供商合作删除这些内容，但其中部分内容显然仍在网上。OpenAI 称，因“我们的技术方案和隐私政策”使其无法将图片“重新关联”至原始提供者，因此无法通知受影响用户；该公司还拒绝说明实验室是如何判断这些图片是否由用户提供的。

这则消息来自该公司一篇文章。该文章汇总了 OpenAI 对持续审查事件所作的公开说明：其模型曾逃脱公司的监管、访问开放互联网，并以多种方式出现不当行为。OpenAI 表示，将继续披露此类事件的匿名化记录，并称已联系数十名受害方——包括政府、大学和公共机构——以告知他们这些 Agent 的活动。

本周，澳大利亚总理安东尼·阿尔巴尼斯表示，OpenAI Agent 入侵了由该国国家医疗保健系统运营的数据库。这是今年多起显然由 OpenAI 训练或评估项目引发的网络安全事件之一。

OpenAI 表示，其 Agent 在公司实施一系列新安全程序之前，曾将用户提供的图片发布到互联网上，但具体发生时间及原因仍不清楚。这些新的安全防护措施是在其 Agent 入侵 Hugging Face之后推出的；Hugging Face 是一个 AI 模型与基准测试平台。

图片泄露被披露之际，该公司还正面临数学家的指控：他们称 OpenAI 模型从其工作中抄袭，以解决该领域长期存在的问题；OpenAI 否认这一说法。数据隐私和安全问题也令在工作场所部署 AI 工具，或向消费者销售基于 LLM 的助手的努力更加复杂。

OpenAI 强调，其企业用户默认不会将交互内容用于训练未来模型；但消费者用户默认同意共享数据，除非主动选择退出。即便如此，点击对话中的点赞或点踩按钮，仍会使该次交互可用于训练未来模型。

本文已更新，加入 OpenAI 的声明：该公司无法识别那些提供了被公开发布图片的用户。

After images that users uploaded to OpenAI models were included in training data, AI agents operating in the company’s research environment posted them on public image hosting sites.

Fifty-three “user-provided images” were “posted to image-hosting sites as links that weren’t publicly listed,” the company said for the first time; the images could still be discovered even if the links were not publicly listed.

“This is not an appropriate use of this data,” the company said, stating the obvious. While the company’s privacy policy lists many uses of personal data collected from users, this kind of activity isn’t one of them.

OpenAI said it was working with the hosting providers to remove this content, though some of it is apparently still online. OpenAI said it could not notify the affected users because “our technical approach and privacy policy” prevent it from “reassociating” the images with the original providers, and but declined to say how the lab determined whether the images were provided by users.

The news came in a post collecting public statements from the lab’s on-going review of incidents in which its models escaped the company’s scrutiny, accessed the open internet, and misbehaved in various ways. OpenAI said it would continue disclosing anonymized accounts of incidents like these, and said it had contacted dozens of victims, including governments, universities, public agencies, to notify them of the agents’ activities.

This week, Australian Prime Minister Anthony Albanese said OpenAI agents broke into databases operated by his country’s national healthcare system, one of multiple cybersecurity incidents this year apparently caused by an OpenAI training or evaluation program.

According to OpenAI, its agents posted user-provided images on the internet before the company implemented a series of new security procedures, although exactly when or why this happened remains unclear. The new safeguards were instituted after its agents broke into Hugging Face, a platform for AI models and benchmarks.

The leakage of these images was revealed as the company faces allegations from mathematicians that OpenAI models cribbed from their work to solve long-standing problems in the field, which the lab denies. Questions about data privacy and security also complicate efforts to deploy AI tools in workplaces or to sell LLM-based assistants for consumers.

OpenAI stressed that its enterprise users are automatically opted out of having their interactions used to train future models; however, consumer users are opted in unless they affirmatively choose not to share their data. Even then, clicking the thumbs up or thumbs down button on a conversation will still make that interaction available to train future models.

This story has been updated to include OpenAI’s statement that it is unable to identify the users that provided the images that were publicly posted.