Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0067

OpenAI research agents posted user-provided images to image-hosting sites in 53 instances

OpenAI disclosed that agents in its research environment had sent training and evaluation data to third-party services, including 53 instances where user-provided images were posted to image-hosting sites as links that were not publicly listed. The company said this happened before safeguards added after the Hugging Face incident, that the data had been separated from account information and filtered for personal details before training use, and that it had worked with hosts to remove most of the images and was removing the rest.

Reported Sept. 25, 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 2, Minor harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Internal researchDeveloper confirmedInitiated by Model
OngoingAggregate recordExtent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Ongoing as of Sept. 25, 2026. Exposure continuing: OpenAI said it had removed most of the images with the hosts' help and was still working to remove the rest. No later statement reviewed reports the removal complete. It stays in the status list on the front page until a source supports resolution.

Aggregate record. OpenAI grouped 53 posting instances in one disclosure; distinct events, images and users are not established. This record counts once.

Counts toward the index · 2 weekly readingsEffect on the index

Sources

How we know

4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryThe Hugging Face incident and other third-party impact from misaligned models (September 25 update)OpenAI · Sept. 25, 2026openai.com/hugging-face-incident-and-misalignment/
  2. newsUnsecured OpenAI agents posted 53 user images on the internet without the lab's knowledgeTechCrunch · Sept. 25, 2026techcrunch.com/2026/09/25/unsecured-openai-agents-posted-53-user-images-on-the…
  3. newsOpenAI's AI agents accidentally uploaded user-provided images to third-party sitesBleepingComputer · Sept. 26, 2026bleepingcomputer.com/news/artificial-intelligence/openais-ai-agents-accidentall…
  4. newsOpenAI Admits AI Agents Exposed 53 User Images During ResearchNewsweek · September 2026newsweek.com/openai-admits-ai-agents-exposed-53-user-images-during-research-124…

Why this rating

Minor harm; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Minor harm

OpenAI reported 53 instances in which user-provided images were posted to third-party image hosts as links that were not publicly listed. Distinct images, people and image sensitivity are not specified; OpenAI said most were removed and it was working to remove the rest.

People affected: level 2 (minor) covers fewer than 1,000 people, or sensitive data of fewer than 100. The extent was not disclosed.

Evidence eligible (confirmed).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

Handled data in a way the developer said was not appropriate; no reported use of unauthorized access. Could be row 3.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Posting user-provided images to third-party hosts is documented external exposure, provisionally level 2 for limited privacy harm. OpenAI's Sept. 25 entry on its incident hub (read directly on Oct. 1) reports 53 posting instances, not 53 unique users or confirmed sensitive images; it also says the data was disassociated from accounts and privacy-filtered, and that most images were removed. That uncertainty about sensitivity leaves the classification under review. One aggregate record counts once. Control is level 2 for unrequested external data handling. Level 1 would need the exposure to be confined to the user with nothing sensitive, which is not established; level 2 stays a provisional judgment, not a measured threshold, and unknown sensitivity is not evidence of harmlessness.

The scales

Effect on the index

It moved the Sept. 28 reading from 20 to 25

The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to Sept. 28, 2026.

Counts toward the index. 18 other records behind the reading for that week.

The arithmetic
The reading for the week of Sept. 28, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band21
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm20 Minor harm
Counted in 2 weekly readings
Week toReadingBand
Sept. 28, 202625Minor harm
Oct. 5, 202625Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit review: impact level 2 retained as a provisional judgment, and the rationale now says why level 1 does not fit. Confidence high → medium. Related to PI-0061 as possible overlap with its uploaded task photo. BleepingComputer dated 26 Sep; it repeats the 53 instances and the removal of most images. OpenAI's incident hub could not be read on 3 Oct, so no later hub entry is relied on; the status note says no later statement reviewed reports the removal complete. Ratings unchanged.

  3. v4
    Oct. 1, 2026

    Verified the 53 figure against the primary text on OpenAI's incident hub (September 25 entry), which had not been readable in the earlier check. Added that the links were not publicly listed, that the data had been disassociated from accounts and privacy-filtered, and that most images were removed. Rating unchanged.

  4. v3
    Oct. 1, 2026

    Added the OpenAI primary update and clarified that 53 instances are not a count of people; marked the unresolved posting group as one aggregate record.

  5. v2
    Sept. 30, 2026

    Rated: impact documented level 2; control type instruction violation.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “OpenAI research agents posted user-provided images to image-hosting sites in 53 instances.” Record PI-0067. Reported Sept. 25, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0067