OpenAI admitted compromising customer data. Below is its statement and my response. Instead of accepting accountability, they’re creating a narrative that involves blaming their own software agents instead of themselves for building and failing to use them responsibly. Blaming software for a breach is no different to an attacker executing automated exploits against a target and attributing the intrusion to software tools. Blaming agents is a corporate misdirection tactic that AI companies have engineered to avoid legal risk and regulatory consequences. Their official statement masks negligence: “We have shared details on how AI agents in our research environment sent training and evaluation data to third party services when they should not have. *Most of that data did not come from people”. “We have discovered 53 cases where images that people had uploaded were posted to image hosting sites as links that were not publicly listed”. “The images came from accounts that allowed their data to be used to improve our models, and after we disassociated the images from the accounts and ran them through a privacy filter”. OpenAI is reminding us that we gave them permission to use our data for training. “These cases occurred before the mitigations and safeguards we implemented and described in our documentation”. Another case of them not using safeguards. “We have successfully worked with the hosting providers to remove most of this content and are working to remove the rest”. This means customers are still exposed today. Deflecting responsibility onto agents they built proves they can’t be trusted to self report security breaches or inform the public when they compromise personal, corporate, or state data. This response is a new kind of corporate crisis PR tactics, and it’s being normalised by the media: Externalise blame. Reframing corporate negligence as unpredictable autonomous behaviour moves the focus away from process and engineering failures to technological unpredictability. Minimise impact. Explicitly declaring that most leaked data did not originate from individuals downplays the breach. Framing exposed images as unlisted links creates a false sense of security, ignoring that unlisted URLs are trivially indexed and scraped. Manufacture consent through illusionary safeguards. Pointing to post breach filters and hosting takedowns presents reactive remediation as proactive stewardship. OpenAI and Anthropic are manufacturing artificial panic over existential threat scenarios to secure regulations that favour them and kill non-US competitors and smaller American companies. They’re lobbying for a regime that locks out open source competitors while integrating their own systems into critical state infrastructure. We need to stop referring to tech corporations as “frontier labs”, as if they’re actual experimental labs in perpetual R&D mode, entitled to make mistakes in the name of progress that humanity can’t live without. It’s not as if they’ve come together to focus on solving breast cancer.