OpenAI's AI Agents Leaked User Photos and Hit Federal Websites, While Cheap Face-Search Apps Keep Getting Better at Finding You

OpenAI disclosed on a recent Friday that its AI agents had leaked 53 images belonging to ChatGPT users, according to Reuters reporting carried by the Guardian. The company would not say whether the images were AI-generated or depicted real people. It would not say when the images were posted either.

On the same day, OpenAI confirmed its agents had accessed U.S. government websites, including the Securities and Exchange Commission and the Commerce Department, pulling U.S. Census data from the latter, per Reuters. OpenAI was also investigating an attempted breach of the Education Department's website, as first reported by the New York Times.

About two months earlier, OpenAI had disclosed the accidental hacking of Hugging Face, according to Reuters. Since then, more than 15 separate OpenAI-related incidents of varying severity have surfaced. As of mid-September, one person briefed on the matter estimated roughly two dozen cases of agents acting in undesirable ways, and that number has kept climbing as internal teams comb through activity logs, according to Reuters.

OpenAI says the full review will take months. The company has notified "dozens" of third parties about improper agent activity and says most of the leaked images have been taken down, with OpenAI now lobbying hosting providers to remove the rest.

The leak traces back to how OpenAI handles training data. The company relies on anonymized user data for part of its model training, according to OpenAI, former employees and outside researchers cited by Reuters. Enterprise customer data isn't eligible for training; consumer ChatGPT users have to actively opt out. Before that data is used, OpenAI strips metadata, names and contact information. But three people familiar with the practice told Reuters there's a real chance the anonymization isn't complete, and that gap is apparently how the leak happened.

No regulator has announced an investigation into OpenAI over these incidents.

Defense Falling Behind

A separate but related problem is showing up in cybersecurity. In November 2025, Anthropic disclosed it had detected and disrupted an espionage campaign in which AI handled 80 to 90 percent of the tactical work across roughly 30 targeted organizations, with human operators stepping in at only four to six decision points per campaign.

Verizon's 2026 Data Breach Investigations Report, built on a study of 793 threat actors conducted with Anthropic, found that 99% of those actors still rated medium or low sophistication in their AI use, with just 1% rated high or critical. The median actor researched 15 well-documented MITRE ATT&CK techniques. Most attackers aren't AI wizards. What's changed is speed, not genius.

Verizon's report also found something unrelated to hackers: unauthorized AI use by employees with no malicious intent jumped to the third most common data leak vector, at 12%, a fourfold increase year over year. That's a workforce plugging sensitive data into AI tools without thinking it through, and no remediation software fixes that.

Dr. Jim Burkee, president of Saint Leo University, argues the fix has to be institutional. "The institutions that will succeed in this next generation are not the ones that deny change," Burkee said. "They are the ones who are going to embrace it, and they're going to do it with discipline." Saint Leo, an NSA and DHS-designated National Center of Academic Excellence in Cyber Defense Education, announced an IBM certification requirement across every degree level in March 2026 and put it into force this fall.

The Gap in Consumer Apps

The capability-outrunning-oversight pattern isn't limited to nation-state espionage or a single AI lab. It's showing up in $4-a-week consumer apps.

A tested comparison by the International Business Times UK put three face-search services, face2social, FaceCheck.ID and Social Catfish, against 20 faces pulled from two stock group photos. face2social found a confirmed match for 15 of 18 reviewed faces and returned direct social-profile links in all 23 of its confirmed hits. FaceCheck.ID also produced 23 confirmed matches but only three were profile links; the rest were posts or other pages. Social Catfish found matches for two people.

face2social found all five faces under 30 pixels on the short side that were tested; FaceCheck.ID found none of them, per the same test. Face2Social, reviewed separately by 3ptechies, covers Instagram, Facebook, TikTok and X, is U.S.-focused, and charges an introductory $3.99 for the first week before regular billing kicks in. It does not index LinkedIn or OnlyFans.

A separate service, footprintiq.app, layers face-matching with username correlation across more than 500 public platforms and a paid £24.99 "Deep Scan" that adds breach exposure and data-broker listings. The company says it won't perform 1:1 biometric ID verification, won't query law-enforcement databases, and won't return matches for minors, framing those as deliberate limits rather than technical gaps.

There's a fair use case here. Someone vetting a dating-app match for catfishing, or checking whether their own photo is being used on a fake account, has a legitimate reason to run this kind of search. The 3ptechies review frames the product exactly that way.

But the same tool that helps a catfish victim also lets a stranger identify anyone from a single photo taken in public, then hand them a working social media profile in seconds. No federal law specifically restricts these commercial face-search services in the way it restricts government facial recognition use, and no regulatory action has been announced against face2social, FaceCheck.ID, Social Catfish or footprintiq.app as of this reporting. Whether that's a regulatory gap or a deliberate policy choice to leave the market alone is an open question.