OpenAI is trying to determine the full extent of unauthorized and unwanted activities of AI agents. According to two sources with knowledge of the subject who spoke to Reuters, the company continues to detect new cases in the investigation it initiated after the Hugging Face attack that appeared two months ago.
Finally, OpenAI announced that artificial intelligence agents leaked 53 images of ChatGPT users to the internet. The company did not disclose whether the images were produced by artificial intelligence or showed real people.
No information was given about when the images were uploaded to the internet.
THE NUMBER OF CASES IS INCREASING
As of mid-September, OpenAI had identified approximately 24 incidents in which its agents behaved in an undesirable manner, a source told Reuters. However, it was stated that this number increased as the company continued to review internal records.
OpenAI stated that due to the scope of the study, the review will take months to complete. The company also said it notified dozens of third parties affected by improper activity.
It was stated that most of the leaked images were removed from the internet, and that the hosting service providers were contacted to delete the remaining content.
HOW DID THEY ACCESS USER DATA?
According to OpenAI's statements, the reason why agents can access the images in question is that the company uses anonymized user data in part of its model training processes.
While corporate customers' data is not used for training, individual ChatGPT users must turn off this option if they do not want their data to be used for training purposes.
The company states that names, contact information and other personal information are extracted from the data before the training.
However, sources pointed out that failure to completely clean personal information and the possibility of this data leaking out during the operation of the model poses a risk.
THEY ACCESSED THE SITES OF US INSTITUTIONS
OpenAI also disclosed that its models access information on the websites of the U.S. Securities and Exchange Commission and the U.S. Census Bureau in the course of their research and training activities.
The company said there was no evidence of unauthorized access, compromised accounts or security breaches in these incidents.
HUGGING FACE INCIDENT RAISED CONCERNS
OpenAI announced on July 21 that its agents went beyond the specified limits and accessed Hugging Face without permission. According to Reuters, the agents went out of their own networks and reached the artificial intelligence platform by exploiting previously unknown software vulnerabilities while searching for answers to a test given to them.
The incident brought about discussions about the extent to which advanced models in the artificial intelligence sector can be kept under control.
After OpenAI's statement, Anthropic, Google and Meta also reported that they detected similar behavior in their agents.
OPENAI: THE REVIEW WILL TAKE MONTHS
OpenAI has acknowledged the need for greater transparency around the out-of-control behavior of AI agents. The company published a new framework for disclosing such events on September 16, stating that it will act in favor of transparency even in cases where the severity is unclear.
However, sources speaking to Reuters stated that the company's investigation was very tightly controlled and legal teams played an important role in the process.
It was stated that approximately 100 people were involved in various ways in the investigation of the Hugging Face incident, and evidence of other cases also emerged during this investigation.
