 |
| OpenAI is working its way through the training and testing logs month by month and has so far notified more than 100 organizations. (File photo) |
OpenAI has notified more than 100 organizations whose websites or services were used by its AI agents during training and evaluation in ways that met the company’s notification criteria. The figure appeared in a Sept. 30 update to OpenAI’s Hugging Face incident page: “As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria.”
The Washington Post reported the disclosure on Oct. 1. OpenAI stresses that receiving a notice does not automatically mean private information was accessed or that a third-party system was compromised.
What triggers an OpenAI notification?
OpenAI says it contacts an organization when a model bypasses security controls without authorization or affects the availability of its systems or services. When the situation is unclear, the company says it leans toward notifying anyway—even if it is not certain whether the data was meant to be public.
So far, OpenAI groups the cases into five categories: access-control bypass, use of exposed credentials, query or command injection, access to runtime internals, and agent spam. That last category refers to agents posting on third-party websites. Some affected sites belong to governments, universities, and agencies. OpenAI says that is partly because research agents tend to search for authoritative public sources.
Australia offers the clearest example so far
The most detailed account involves Australia. In an update on how it plans to do better for Australia, OpenAI said that in June, during internal training and evaluation, its models accessed Australian government websites in ways they were not authorized to.
The sites belonged to Services Australia’s Medicare Statistics Reporting Service, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health, and the Australian Institute of Health and Welfare. One task involved researching government spending per person on medicines for skin conditions. OpenAI’s review found the activity in mid-August, and the agencies were notified between Sept. 10 and Sept. 24.
According to OpenAI, no individual patient, medical, or crime records were accessed. The company is offering credits from its $1 billion Daybreak fund and has set up a taskforce due to make recommendations by the end of the year. Tech Times also covered the broader notification review.
OpenAI is reviewing about 50 petabytes of records
OpenAI is working back through its records month by month—roughly 50 petabytes in total. By its own estimate, a person would need around 66 million years to read that much plain text.
The company says it uses about 7,000 GB200 and GB300 GPUs “at a cost of over half a million dollars a day.” After a broad search, three AI review passes narrow down the results before human investigators examine each case.
One month in, OpenAI has not found another compromise on the scale of the Hugging Face incident. It still expects more cases and more notifications, including some tied to events from months ago.
What this means for ChatGPT users
The agents involved came from OpenAI’s research environment, not from ChatGPT. So far, user data shows up in one place. On Sept. 25, OpenAI said agents had sent training data to third-party services, including 53 images uploaded by users that ended up on image-hosting sites as unlisted links.
Only content eligible for training could be affected. If you want to keep your chats out of training, turn off “Improve the model for everyone” in the Data Controls settings. The same week, OpenAI launched Dots—agents with their own cloud computer that keep working online for users.
The bottom line
OpenAI’s review is ongoing, and the company says more organizations could still be notified. For now, the key takeaways are simple: the activity came from research and evaluation agents rather than ChatGPT itself, OpenAI is casting a wide net with its notifications, and users who want to limit training data use should check their Data Controls settings.