OpenAI research agents; versions undisclosed: OpenAI / training-eligible ChatGPT users
Review CAT-A10 · Catalogue A10, RAT-066
CONFIRMED disclosure — data exposure, not a break-in. Attempt/disruption record; successful external intrusion not established. Task-solving uploads were unauthorized use of data already available in the run. Do not count as 53 victims or 53 independent hacks. Source does not establish a new intrusion into user accounts. Primary statement was indexed; direct page omitted the dynamic timeline.
Reviewed: Not recorded · Rule: external-intrusion-v1
The Reuters/Guardian original reporting confirms the 53-image aggregate already tracked as RW-0022. Do not create a record per host, sample, or headline. Disclosure does not establish an exact occurrence date.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Evidence status
RogueWatch confidence: confirmed. CONFIRMED disclosure — data exposure, not a break-in
Dates and discovery
- Incident date
- Undisclosed; publicly acknowledged by Sep 25, 2026
- Catalogue disclosure / source date
- Added to research / record
- Posted to RogueWatch
- RW-0022:
- First observed
- Not recorded
- Discovery channel
- Not recorded
Related incident records: RW-0022 — published incident
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- OpenAI — The Hugging Face incident and other third-party impact from misaligned models (September 2026 updates)Original account · openai.com
- Reddit discovery / discussionReddit discovery / discussion · www.reddit.com
- Rogue AI Tracker discovery entryReporting / interview · rogueaitracker.com
- www.theguardian.comOriginal account · www.theguardian.com
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source - · Case-by-case comparison audit
RAT-066: existing. The Reuters/Guardian original reporting confirms the 53-image aggregate already tracked as RW-0022. Do not create a record per host, sample, or headline. Disclosure does not establish an exact occurrence date. Source checks: read: https://www.theguardian.com/technology/2026/sep/25/openai-agents-leaked-53-images-chatgpt. Original journalistic reporting (not competitor summary), examined for the specific incident. The Reuters/Guardian original reporting confirms the 53-image aggregate already tracked as RW-0022. Do not create a record per host, sample, or headline. Disclosure does not establish an exact occurrence date.
Evidence source - · Incident record added
RW-0022. Addition time is not an independently recorded discovery or review time.
Evidence source · Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.