OpenAI's Navier-Stokes statement on user data has two parts, not a firm "we don't train on your data" promise

Retrieval at inference time is one promise. Training on your content is a second one, and a third, which almost no procurement checklist names, covers de-identified derivatives of your usage. OpenAI's announcement makes the first: no specific user data was accessed in order to solve this problem ^[9]. It declines the third in writing, saying that while unlikely, it cannot rule out that de-identified data derived from their usage of its products helped improve its models ^[9]. On the second, Buckmaster says he asked twice and got an answer only about lookup. He was told the model did not look up user data, and when he asked again about training, no answer came ^[8].

The timing is why that gap carries weight. OpenAI says it started training the internal model on August 28 ^[3] and announced the proof on September 8 ^[4], eleven days later ^[14]. Buckmaster and Alpöge had been working on the problem for close to a year ^[6], with drafts going into Codex sessions the whole time ^[8]. Buckmaster's reading of the carve-out, posted on Mastodon, is that OpenAI is "openly admitting they used training data from a period after we found our result" ^[11]. Sébastien Bubeck of OpenAI says the team saw none of their work until it was public, and that the two proofs differ significantly ^[10]. Both proofs do use the route pioneered by Diego Córdoba and Luis Martínez-Zoroa, and Javier Gómez-Serrano of Brown University says that approach was one of several thought to hold promise ^[13], so the shared route settles nothing in either direction.

Teams tell themselves users read the data controls page, work out which toggle governs training, and keep the sensitive material out of the surfaces the toggle does not cover. What users actually do looks different. They put the work where the tool is, for a year, because that is where the tool is useful ^[8]. Depth of use is the number worth watching. It is also the number that creates the exposure. Someone who pastes one function into an assistant risks little. The customer who has kept an entire unpublished project in one vendor's session history has far more at stake, and is the customer a renewal depends on.

The 2x2 has two axes. First, is the assurance contractual, in a document with a counterparty and a remedy, or is it a statement, in a blog post or a post on X ^[15]? Second, does it cover only retrieval of your data, or does it also cover derivatives, including de-identified ones? Most assurances an operator can actually produce on request sit in the weakest quadrant, statement plus retrieval only, which is the quadrant OpenAI's language occupies here. The useful exercise is writing out the sentence you would need about your team's unpublished work, then finding which document contains it. If the answer is a blog post, you have a press release where you wanted a term.

Which is where credit lands. A proof produced by an internal model running 10,000 concurrent agents ^[1] can be checked in detail only by people with access to that setup, and according to Buckmaster's document, the offer of joint authorship came with Alpöge dropped because he works at Anthropic ^[12]. Attribution here depends on logs that one party can read, and that party's own carve-out says the logs may not settle it.