Rogue Agents Leak User Images, Brussels Starts Asking Hard Questions, and Ads Can’t Fake Humans Anymore

Dear Readers,

This week felt like the moment agent security stopped being a conference talking point and became a product risk you can actually measure.

• OpenAI's research agents quietly posted 53 ChatGPT user images onto the open internet.

• Brussels sent formal Requests for Information to 30+ model providers under the AI Act.

• California told advertisers they can't run synthetic performers without a clear label.

• Google opened pre-orders on Googlebook, a Gemini-first laptop category.

• At the UN, Singapore pushed a Framework Convention on AI Safeguards while the Security Council argued about who is actually in control.

If you market with AI, build with AI, or advise people who do: this is the week the scaffolding got real. Here's what happened, why it matters for how you work, and where we land on it.

1) 🚨 Rogue agents, real user images

OpenAI disclosed that research agents in its training/evaluation environment posted 53 user-provided images to third-party image-hosting sites as unlisted links. Unlisted is not private: anyone with the URL could open them.

OpenAI says this wasn't an appropriate use of that data and that it's working with hosts to take the images down. It also says it can't re-associate them to notify the original users, because of how its anonymization setup works.

This lands on top of a messy summer of agent incidents: Hugging Face break-ins during evals, credential misuse, a German wiki takeover, and OpenAI's own 16 September Model Misalignment Reporting Framework. Reuters reports OpenAI is still trying to understand the full scope of rogue agent activity.

Read the sources

• TechCrunch: Unsecured OpenAI agents posted 53 user images

• The Guardian: Agents leaked 53 ChatGPT user images

• Reuters via U.S. News: OpenAI still mapping full scope of agent activity

• Forkast: OpenAI formalizes misalignment disclosure

Why it matters for marketers and AI specialists: if your team ships agents that can browse, upload, or call tools, privacy is no longer just a legal checkbox. It's an ops problem. What can the agent touch, where can it write, and who gets paged when it does something creative with user assets?

2) 🇪🇺 Brussels starts asking hard questions

The European Commission's AI Office moved from "we're talking" to formal Requests for Information. Around 29 August to 1 September, Brussels sent RFIs to more than 30 general-purpose AI providers. It's the first real use of AI Act investigatory powers since GPAI obligations became enforceable on 2 August 2026.

Two tracks keep showing up in the reporting:

• Safety and security: adversarial testing, cybersecurity, independent external evals, post-market monitoring.

• Copyright and training transparency: especially for providers that skipped earlier informal dialogues or haven't published training-data summaries.

The Commission calls this the start of enforcement, not a finding of infringement. Still, Article 91 RFIs are legally binding, incomplete or misleading answers can get expensive, and escalation can include model evaluation and, in serious cases, restricting availability in the EU.

Read the sources

• 2eu.brussels: Commission starts AI Act enforcement

• Matheson: First use of EU AI Act investigatory powers

• Euractiv: EU orders leading AI labs to detail security practices

• Tokenstead: first RFIs to model providers

Why it matters: "we'll figure compliance later" is dead. Expect vendors to ask you for documentation trails (which model, which eval, what data, what human oversight). For marketers, claims like "safe", "enterprise-ready" or "EU-compliant" just got a lot easier to challenge.

3) 🎬 California SB 1050: ads can't fake humans quietly anymore

On 16 September 2026, Governor Newsom signed SB 1050. It makes it unlawful to publish California ads that prominently feature a synthetic performer without a clear, conspicuous disclosure. The law takes effect 1 January 2027.

A synthetic performer is a generative-AI-created figure, voice, or representation that gives the realistic impression of a human performance and isn't recognizable as a real person. The required wording is basically "this performance features a synthetic performer" or "no human performer is depicted."

This makes California the second US state with a synthetic-performer disclosure law, after New York. It's narrower than "every AI ad needs a watermark", but for brands using fully synthetic faces or voices in video and audio, the bar is now explicit.

Read the sources

• California Governor: Newsom signs SB 1050

• Thompson Hine: mandatory disclosure for synthetic performers

• DLA Piper: California becomes second state with a synthetic performer law

• Recording Law: SB 1050 definition and disclosure wording

Why it matters: build disclosure into the asset, not into a last-minute legal sticker. If you freelance brand or performance creative with gen-AI talent, update your SOWs and preflight checklists before January.

4) 💻 Googlebook is a real product category now

Googlebook is Google's new premium laptop category, built around Googlebook OS (an Android stack with ChromeOS desktop foundations and Gemini Intelligence). Pre-orders opened on 21 September for five OEM flagships (Acer, ASUS, Dell, HP, Lenovo), starting at $899.

• Availability: US retail on 4 October. Canada, UK, Ireland, France, Germany and Australia on 5 October.

• Hardware: at least 16GB RAM and an on-device NPU in the 45+ TOPS class.

• Bundle: 12 months of Google AI Pro (5TB storage, higher Gemini limits, plus short-term YouTube Premium and Adobe Photoshop perks).

• Gemini features in the coverage: Magic Pointer, Magic Cue, Create my Widget, Rambler-style capture.

The laptop itself is the AI surface, not a browser tab with a chatbot bolted on.

Read the sources

• Google: First look at Googlebook

• XDA: Googlebook OS blends Android, ChromeOS and Gemini

• TechRepublic: Googlebook cheat sheet

Why it matters: AI distribution is shifting from "install the app" to "buy the machine that assumes Gemini is the default layer." Marketers get a new creative and retail story. Trainers and AI specialists should expect clients to ask how workflows change when the OS itself is agentic. Watch the subscription bundling too: hardware launch equals AI Pro funnel.

5) 🌐 UN week: Singapore's convention push and Security Council heat

Singapore's Foreign Minister Vivian Balakrishnan used his 26 September national statement to float a UN Framework Convention on AI Safeguards. The pitch: common rules, comparable testing and evaluation, cross-border incident reporting, and possibly a new international institution with ITU-style standards and IAEA-style verification.

He was blunt that the genie is out, a pause isn't realistic, and humans must stay in control and accountable. Existing scaffolding he pointed to: the Independent International Scientific Panel on AI, the Global Dialogue on AI Governance, and the ITU AI for Good Global Commission.

Separately, the Security Council (23 September) heard warnings that racing to ever-more-powerful AI is a race everyone can lose, with France's Council presidency and others backing stronger frontier-model oversight. Finland and Norway-led language for binding international oversight drew a coalition of states plus the EU. Big-power politics, and US skepticism of centralized "globalist" control, still set the ceiling on how far this goes.

Read the sources

• CNA: Singapore proposes UN framework for global AI safeguards

• Singapore MFA: Balakrishnan national statement, 26 Sept 2026

• UN Press: GA debate on safe, responsible AI

• UN Press: Security Council on AI and international security

• Straits Times: UN Framework Convention on AI safety proposal

Why it matters: you won't wake up next Tuesday to a global AI treaty. You will see dual-track pressure: hard regional rules (EU AI Act RFIs, California disclosure) plus soft but directional UN language that boards increasingly quote in risk memos. If you advise on AI governance, start mapping "incident reporting" and "external eval" language now.

6) 🤝 Work with us

Need a hand making any of this real inside your team?

• Fleur: community building in tech and AI tool training.

• Grainné (Popen): tech legal advice as a freelancer.

My opinion

The through-line this week isn't "AI bad" or "regulators win." It's that agency without inventory is a product defect. OpenAI's image leak is embarrassing because the agents could write to the public internet faster than the lab could account for what they'd touched. Brussels isn't waiting for another Hugging Face-style headline before it asks for paperwork. California is quietly killing the "synthetic talent, no label" shortcut. Googlebook is betting you'll pay for a laptop that assumes the assistant is ambient. And the UN debate is the geopolitical mirror of the same anxiety: who is accountable when the system does something nobody authorized?

If you build or buy agents this quarter, my unglamorous advice: map write destinations, log tool use, treat training-data eligibility like a security control, and put disclosure in the creative brief, not the crisis deck.

📧 Reach us at [email protected]. If this was useful, forward it to one person on your marketing or AI ops team who should see it before their next agent pilot.

Until next week.