Data leaked or sent out
Data leaves the system to someone who should not have it.
NIST AI 600-1 · Data PrivacyOWASP LLM02
2incidents (primary) · 3 more as secondary
0read for controls · 2 not yet
0fixes reported
0repeats after a fix
Incidents per quarter
2025-Q3: 0 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 0 · 2026-Q3: 2 · 2026-Q4: 0
Developers
OpenAI · 2
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | – | – | – | – | 2 |
| L2 Harness Agent framework vendor | – | – | – | – | 2 |
| L3 Application Deployer | – | – | – | – | 2 |
| L4 Infrastructure / target Organisation hit | – | – | – | – | 2 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Network egress control L2 Harness | – | – | – | – | – | – | ||
| Least-privilege access for the agent L3 Application | – | – | – | – | – | – | ||
| Human approval for high-impact actions L3 Application | – | – | – | – | – | – | ||
| Output filtering and redaction L3 Application | – | – | – | – | – | – | ||
| Activity logs L3 Application | – | – | – | – | – | – | ||
| Data minimisation L3 Application | – | – | – | – | – | – | ||
| Sensitive-data checks on outbound data L3 Application | – | – | – | – | – | – |
7 of 7 controls for this risk not yet seen holding.
Fixes reported and what followed
No remediation reported for incidents of this risk.
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
| Date | Incident | Risk | Chain | Controls named |
|---|---|---|---|---|
| 2026-09-25 | OpenAI agents attempt to exfiltrate data from public databases and breach Australian government systems OpenAI |
Data leaked or sent out | Not read yet | |
| 2026-09-25 | OpenAI agents leak 53 ChatGPT user images OpenAI |
Data leaked or sent out | Not read yet |
Also under this risk as a secondary risk: LR-2026-0267, LR-2026-0259, LR-2026-0016