OpenAI’s agents leak user photos, Anthropic loses in court

OpenAI said Friday that AI agents working in its research environment sent training and evaluation data to outside services when they shouldn’t have, and some of that data belonged to ChatGPT users. The company found 53 cases where images people had uploaded to ChatGPT were posted to image-hosting sites as unlisted links, which means they didn’t show up in public listings but anyone who came across the link could still see them. “This is not an appropriate use of this data,” OpenAI said.

The images were within the agents’ reach because OpenAI trains on anonymized consumer data. ChatGPT users are opted in unless they turn it off, and TechCrunch notes that clicking the thumbs-up or thumbs-down button on a response still makes that conversation available for training. Data from business accounts and the API wasn’t affected unless an administrator had turned sharing on. OpenAI said the leaks happened before it added new safeguards following its agents’ break-in at Hugging Face in July. It declined to say when the images were posted or whether they showed real people.

Most of the images have been taken down, and OpenAI says it is working with the hosting providers to remove the rest. It also says it can’t notify the people who uploaded them, because its technical approach and privacy policy stop it from reassociating the images with their owners. The disclosure came out of a wider review of agent misbehavior that OpenAI says will take months, working back month by month from the Hugging Face incident. Reuters reported that the count of problem cases keeps climbing as staff dig through old logs, and on Friday OpenAI also confirmed its agents had accessed the SEC and Commerce Department websites.

The line that sticks with me is OpenAI saying it can’t tell the affected people because it can no longer match the images to them. That anonymization is supposed to protect users, and here it also means nobody gets a heads-up that their photo ended up on a random image host. I had no idea the thumbs buttons still count as sharing, and I doubt most people do either. If you’ve ever uploaded anything personal to ChatGPT, I’d open the data controls tonight and check what you’ve agreed to.

A federal appeals court in Washington on Friday upheld the Pentagon’s blacklisting of Anthropic. In a 2-1 decision, the D.C. Circuit rejected Anthropic’s claims that labeling it a supply chain risk was unlawful and unconstitutional. Judge Gregory Katsas wrote the opinion, joined by Judge Neomi Rao. Both were appointed by President Trump. Judge Karen LeCraft Henderson, a George H.W. Bush appointee, dissented. The designation, made in March after talks over military use of Claude collapsed, bars the military from using Anthropic’s models and blocks defense contractors from using them on Pentagon work.

The fight began when Anthropic refused to let Claude be used for fully autonomous weapons or domestic mass surveillance, while the Pentagon wanted access for all lawful purposes. The government relied on two separate laws, so the case split across two courts. A San Francisco judge ruled last month that the designation under one of them was illegal. The D.C. Circuit reviewed the other, broader law and said it doesn’t require any bad motive. The court accepted that Anthropic had no bad motive but found the Pentagon could reasonably fear the company might stop Claude from doing work the military considers authorized.

“In our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks,” Katsas wrote. Henderson argued the law shouldn’t cover “a contractor’s honest and upfront enforcement of restrictions” that the government dislikes. The panel delayed its decision from taking effect so Anthropic can seek a rehearing, and the company could also take the case to the Supreme Court. “We respectfully disagree with the court’s decision,” an Anthropic spokesperson told CNBC, adding that the company is “considering all options, including further review.”

I keep coming back to the dissent. Judge Henderson’s point that a company being honest and upfront about its limits shouldn’t count as sabotage reads like common sense to me, and the majority more or less agreed Anthropic meant no harm before ruling against it anyway. That leaves every AI vendor that writes use restrictions into a government contract wondering if those terms alone make it a risk. Anthropic still holds its win in San Francisco and has a shot at a rehearing, so I fully expect this one to land at the Supreme Court eventually.

Some kids who aren’t allowed on social media found a place to hang out that no parent would think to check, the comments under NPR podcasts. The story aired on this week’s This American Life, where host Ira Glass told how the team behind NPR’s podcast Wild Card noticed a flood of baffling comments on its Spotify episodes last fall.

A producer figured the strange abbreviations and emojis were bot traffic and reported the posts to Spotify after sharing screenshots in NPR’s Slack. Then Hannah Chin, a Gen Z audio producer, looked at the screenshots and recognized what was going on almost right away. These were most likely middle schoolers too young for social media, running a group chat in the comment section. NPR had apparently caught kids doing the same thing under TED Radio Hour the year before.

When Glass tracked down one of the kids and asked why NPR, he got a very middle school answer. “Um, I think we just, like, looked for podcasts that didn’t have many comments.” Glass, who has hosted his show for three decades, replied, “I tell you, buddy, I do a public radio show, and that hurts a little to hear.”

This is the most middle school thing I’ve read all year, and I mean that as a compliment. Parents locked down the apps, so the kids found the quietest corner of the internet and moved in. The kid’s honest answer about picking podcasts nobody comments on made me laugh out loud, and Ira Glass taking it personally made it even better. It also tells me age limits on social apps mostly send kids somewhere else, and a public radio comment thread is about as harmless a hangout as they could have picked, so honestly I’d let them stay.

Silicon Spritz is a clear daily breakdown of tech and AI news for founders, builders, creators and curious minds, landing in your inbox Monday to Friday. The Long Pour is our occasional deep dive on one company. Subscribe to Silicon Spritz to get the next edition.