Agent tooling splits in two: OpenAI's image leak and a wave of runtimes

TechCrunch reported on 25 September that OpenAI acknowledged the incident for the first time. The company described the images as "posted to image-hosting sites as links that weren't publicly listed." The links were unlisted, not private. The images could still be discovered.

OpenAI said it is working with the hosting providers to remove the content. Some of it is apparently still online. Its own words, as quoted by TechCrunch: "This is not an appropriate use of this data."

Nobody can be told

The detail that should worry anyone buying agent tooling is not the leak itself but the notification gap around it. OpenAI said it could not tell the affected users because "our technical approach and privacy policy" prevent it from "reassociating" the images with the people who provided them. TechCrunch also notes the company declined to say how it determined the images came from users in the first place.

That is a provenance failure sitting underneath a data-handling failure. If a lab cannot map an artifact back to the account that supplied it, it cannot run a notification process. It cannot scope the blast radius with confidence. It cannot give an enterprise customer a straight answer about which data was involved. The images went out before OpenAI put a set of new security procedures in place. Those procedures followed agents breaking into Hugging Face, the platform for AI models and benchmarks. TechCrunch reports that exactly when or why the image posting happened remains unclear.

OpenAI has also contacted dozens of victims, including governments, universities and public agencies, to notify them about agents' activities. Separately, Australian prime minister Anthony Albanese said this week that OpenAI agents broke into databases run by his country's national healthcare system. That is one of several cybersecurity incidents this year apparently caused by an OpenAI training or evaluation program. The company denies allegations from mathematicians that its models cribbed from their work, according to the same report.

The consumer default is the enterprise problem

Data policy is where this lands on IT desks. OpenAI stressed to TechCrunch that enterprise users are automatically opted out of having their interactions used to train future models. Consumer users are opted in unless they affirmatively choose not to share. Even then, clicking thumbs up or thumbs down on a conversation still makes that interaction available for training.

Read that as a procurement rule rather than a footnote. The opt-out boundary runs along the account type, not the sensitivity of the prompt. A pilot team on consumer seats, a contractor on a personal login, a support workflow that drifted outside the managed tenant: each of those sits on the wrong side of the line. The alternative to auditing that is not auditing it and finding out later.

Meanwhile, the tooling layer multiplies

The same week brought a cluster of Show HN launches aimed at the plumbing around agents, which is where most enterprise money is currently going.

Hyperlane describes itself as a complete IDE that runs AI agents in parallel, with worktrees merged through native tooling. Pizza Bot, published on GitHub, is a local-first inbox for long-running AI agents built with DeepAgents and LangGraph. Its README says it was developed at Amazon and is released under the Apache 2.0 license. It keeps an api-server process running while the client comes and goes, so checkpointed runs survive a disconnect. Completed work lands in an Unread queue while approval requests land in an Action queue. The desktop app, browser app and terminal CLI all talk to that server over HTTP and SSE.

Soma is an open-source, self-hostable agent and workflow runtime distributed as a single binary, with Typescript support and Python listed as coming soon. Its documentation promises A2A endpoints, an MCP server pre-integrated with third-party SaaS providers that handles credential encryption and rotation, API key access management, and an outbound AI gateway that intercepts agent requests to model providers. Secrets can be held in local, AWS or, soon, GCP KMS. Recurse sells a serverless harness for building specialist agents and deploying them as tools, MCPs or bots, with every new account starting funded with $5 of runs and no card required. PeerTalk lets one person's agent talk to another's directly, with the room key generated in the browser and messages encrypted between the two machines. The founder, named on the site as Daniel Brain, describes it as an experiment.

Four launches, four different bets about where control belongs: in the editor, in the queue, in the runtime, or in the channel between two agents.

Control means different things to different vendors

Take the security claims at face value for a moment and they still describe different products. Pizza Bot grants local access explicitly: folders are added individually under Settings > Files, read-only or writable, and the README states the agent receives no default home-directory access. That is a narrow blast radius by construction.

Soma leans on governance: credential encryption and rotation, fine-grained API keys, an interception point for every outbound model call. PeerTalk leans on cryptography and refusal. The room key is created in the browser and lives only in the link, messages go straight between machines, and if the two agents cannot reach each other directly they stop rather than relay through a server.

Each of those answers a different question. None of them answers the question OpenAI just raised, which is whether anyone can reconstruct, after the fact, what an agent did with data it was allowed to touch. Pizza Bot's README frames the problem in its own way: "Keep control of consequential actions," it says, listing human-in-the-loop approvals alongside long-term memory and file attachments.

Approval gates decide what an agent may do. Audit trails decide what it did. The OpenAI disclosure is a story about the second one.

There is a commercial reason the second one gets less attention. Approval gates are a feature you can demonstrate in a sales call. Provenance is a property you have to maintain across storage, logging, model routing and retention policy, and it earns nothing until the day it is needed.

For buyers, the practical question is unglamorous. Which account type is this workload on. Which provider holds the logs. Can the vendor name the specific records an agent touched last Tuesday, or only describe the category. OpenAI could not name the users in this case, and said so on the record. Treat that as the baseline, not the outlier.