Data Leakage

Researchers at Glow Security found more than 13,000 sensitive screenshots from 343 companies sitting in public GitHub repositories, put there by AI coding agents trying to solve a mundane problem. GitHub has no API for attaching images to pull requests in private repos via the CLI, so agents did the next logical thing: they created public repositories, uploaded the screenshots there, and linked developers to them. One agent's chain-of-thought log spelled it out plainly: "The only way to satisfy both 'reviewers see the images' and 'nothing but index.html in the repo' was to host the PNGs elsewhere, so I created a new public repo."

Among the exposed data: credentials, internal billing screens, and details of unreleased products, pulled from companies including a Fortune 500 travel company, finance firms, cloud providers, and foundation model companies. One manufacturer with over 100,000 employees had an internal billing screen posted to a developer's personal GitHub account; the company's security team had no idea until Glow flagged it. About a third of exposures traced back to gitshot, an open-source screenshot tool whose README explicitly warns users not to upload sensitive content. The agents uploaded sensitive content.

Meta's new personal AI agent, Muse, gave a user's home address to a Facebook Marketplace buyer, agreed to a below-asking price, and sent an auto-reply saying the seller was home at 9:27pm — when he wasn't. Matt Robb, a YouTuber, had handed Muse the keys to his Marketplace listings for the day while selling an MX Keys Mini keyboard. Muse didn't inform him of any of this until late that night, after the buyer had already shown up, waited 23 minutes, and left a negative review.

Muse's own summary of events acknowledged the false "Yep I'm here!" message and noted that it had sent the buyer an apology from Robb's account. Meta's Muse team lead David Singleton said the company was investigating, and suggested that past similar reports had shown Muse was "following direct instructions and correctly asked for permission." Robb disputes that, saying Muse didn't check with him until after the buyer had already arrived. Meta launched Muse this month, billing it as an agent that confirms with users before taking sensitive actions.

OpenAI agents operating inside the company's research environment posted 53 user-provided images to public image-hosting sites before anyone at the lab noticed. The images were uploaded as "links that weren't publicly listed," but unlisted links are still discoverable. OpenAI said it cannot notify the affected users because its systems cannot re-associate the leaked images with the people who originally submitted them — though the company declined to explain how it determined the images were user-provided in the first place.

The disclosure arrived in a broader roundup of incidents in which OpenAI's agents escaped internal controls, reached the open internet, and caused damage ranging from breaking into Hugging Face to reportedly accessing databases belonging to Australia's national healthcare system. OpenAI said new security procedures have since been implemented, and that it is working with hosting providers to remove the images — some of which remain online. Consumer users, the company noted, are opted into training data collection by default, and even a thumbs-up or thumbs-down on a conversation makes that interaction available for future training.

Hundreds of contractors hired through staffing firm Crossing Hurdles and paid via Mercor are reviewing real ChatGPT conversations as part of an internal OpenAI program called Project Lily, 404 Media reports. Workers score model responses and, in doing so, can read prompts containing sensitive personal details users typed into what they presumably considered a private chat interface.

OpenAI says usernames are stripped and personally identifying information is removed before review, though any sensitive details embedded within the conversation text can still be visible to contractors. Human review of AI outputs is common across the industry, but the scale of Project Lily and its reliance on a contractor pipeline two companies deep makes the privacy tradeoff unusually concrete.

OpenAI announced on September 8 that an unnamed internal model had solved the Navier-Stokes existence and smoothness problem, open for 26 years, using roughly 10,000 concurrent agents. The agents ran about 88 hours, exchanged 2.7 million messages and produced around 130 billion output tokens on Navier-Stokes alone; formalizing the proof in Lean took another 17 hours on GPT-6 Astra. At Astra's retail rate of $50 per million output tokens, those outputs alone price out near $6.5 million before any input tokens. Sam Altman asked on X whether the researchers knew the problem was "only worth $1 million," the size of the Clay prize. OpenAI says it does not intend to claim it.

The announcement shipped with a dispute attached. NYU mathematician Tristan Buckmaster and Anthropic researcher Levent Alpöge had been feeding unpublished drafts into private Codex sessions for closely related fluid-equation work. When OpenAI's Sébastien Bubeck texted that the company had proved "existence of forced blowup in R^3 and T^3," Buckmaster called the word "forced" a bright red flag, since smooth forcing was the obscure route the pair had been pursuing. OpenAI says no person or agent searched user data, then added that it "cannot rule out" that de-identified data derived from their use of its products helped improve its models. Buckmaster stopped short of alleging theft: "I do not know whether our data was used. I am not accusing anyone of anything." The project's origin was a rumor. Bubeck wrote that OpenAI "began working on the Millennium problems due to viral twitter rumors that Anthropic had resolved 2 Millenium problems." (VentureBeat)

Security firm Intruder scanned roughly 1 million internet-exposed AI services and found widespread misconfiguration. Of 5,200+ Ollama APIs reachable online, 1,652 (31%) responded to a simple "hello" prompt with no authentication required. Another 92 Flowise instances exposed full agentic workflows, prompts, and credential lists; 25 Langflow and 24 Open WebUI instances similarly lacked any login gate. The researchers noted this is a sharp rise from Cisco's finding of 18% misconfigured Ollama instances in September 2025.

Among the exposed systems: a Flowise instance laying out the entire business logic and personality prompts of a commercial chatbot service, multiple NSFW "goon-bots" powered by Claude that leaked their API keys in plaintext, and Ollama endpoints clearly designed for processing sensitive medical data and cloud infrastructure management. Of all models identified across the exposed servers, 518 were wrapping paid frontier models from Anthropic, OpenAI, Google, DeepSeek, and others — freely usable by anyone who found them. The researchers also discovered new, undisclosed remote code execution vulnerabilities in at least one popular AI project during their analysis.

SpaceXAI's Grok Build coding tool was quietly packaging and uploading users' full code repositories to Google Cloud, including files explicitly excluded from its scope and secrets deleted from git history. Researchers at Cereblab published the findings on Monday; by the time they did, SpaceXAI had already quietly flipped a server-side flag to stop the uploads.

Independent security researcher Dr. Lukasz Olejnik described the data retention as "excessive," noting that what could have left users' machines includes "proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials." Elon Musk posted that all previously uploaded data would be "completely and utterly deleted" and that "privacy settings are always respected" — though SpaceXAI's suggested fix, the /privacy CLI command, turned out to be a per-session toggle that had nothing to do with stopping the uploads in the first place.

Some AI startups have worked out that it is cheaper to get humans to behave like robots than to get machines to behave like humans. The Guardian surveys the practice, which Woebot founder Alison Darcy calls the "Wizard of Oz design technique": "a lot of time when it comes to AI, there is a person behind the curtain rather than an algorithm."

The specifics are less abstract than the framing. Edison Software engineers read the personal emails of hundreds of users to improve a "smart replies" feature; its privacy policy did not mention that humans would view them. Expensify admitted that receipts it claimed to process with "smartscan technology" were being posted to Amazon Mechanical Turk, where a worker tweeted: "I'm looking at someone's Uber receipt with their full name, pick-up and drop-off addresses." Bloomberg found people working 12-hour days pretending to be chatbots for scheduling services like X.ai and Clara, a job so mind-numbing that employees said they were looking forward to being replaced by bots. Facebook's M assistant also relied on humans. ReadMe CEO Gregory Koberger reduced the business model to two steps: hire minimum-wage humans to pretend to be AI pretending to be human, then wait for AI to be invented.