On 8 September, OpenAI announced that one of its internal models had produced a result on the Navier-Stokes problem, one of the seven Millennium Prize Problems in mathematics.
Ignore the mathematics. There is one sentence in the aftermath that belongs in front of anyone who buys software.
Tristan Buckmaster of NYU’s Courant Institute and Levent Alpöge, who works at Anthropic, had spent close to a year on the same territory. Throughout that year they had been putting every draft of their work into OpenAI’s Codex.
Buckmaster asked OpenAI directly whether its model had been trained on, or had access to, those sessions.
The answer, in two parts
OpenAI denied that its researchers or its agents had seen the work. Sebastien Bubeck of OpenAI, to Fortune:
“We did not use their prompts or proofs to prompt our models or direct our agents.”
That is a clear denial of the specific accusation, and it should be read as one.
Then the second part, from OpenAI’s own statement:
“While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models.”
Both of those can be true at once. Nobody went and read the drafts. And the drafts may still have contributed, through the ordinary operation of a product working as designed.
Why the second sentence is the useful one
Strip out the Millennium Prize and the researchers and what remains is a question every manager can ask on Monday morning.
When somebody on your team pastes a draft into a vendor’s tool, what are the terms? Not what does the marketing page say. What did somebody sign, and has anyone read it since?
Most organisations believe they have settled this. Contracts were negotiated. There is a clause saying the provider will not train on the prompts your staff type in. Legal was satisfied and the matter closed.
What makes this case worth your attention is that it is not hypothetical. A named researcher put the question to a named vendor about a named product, in public, with his own year of work at stake. The answer he got was a denial of direct access alongside an admission that the rest could not be ruled out.
That is more concrete than any policy document a vendor publishes, and it is quotable.
The clause may be covering the wrong thing
There is a second idea worth holding alongside this, and it comes from a Harvard Business School lecturer, William Marks, writing in HBR the same week.
His argument is that the contract everybody signed addresses the wrong asset. Companies have spent years worrying about whether their data goes into someone else’s training set, and have largely concluded that a no-training clause settles it.
What leaves the building may not be the data. It may be the way your organisation solves its problems. The sequence of questions a good analyst asks. The shape of how your team gets from a messy brief to a decision. That is not a document, so no clause about documents covers it.
I should be straight that his article is behind a paywall and I have read only the opening. The argument beyond that premise, and whatever evidence he offers for it, I cannot vouch for. But the premise on its own is worth carrying, because it names something the Buckmaster case demonstrates. He was not worried about a file being copied. He was worried that a year of reasoning had been absorbed.
What to actually do
Three things, none of which need a lawyer in the room first.
Pick the one AI tool your team pastes the most into. Not the one you pay the most for. The one that receives the most unfinished thinking: the half-written proposals, the pricing working, the client briefs before they are tidy.
Open its terms and find the sentence about what the provider may learn from your usage, as distinct from what it may do with your content. Those are two different permissions and the second is usually the one that is written loosely, if it is written at all.
Then decide what you would not want to paste in. Not a policy, a short list. Most teams have never had this conversation and default to pasting everything, because the tool is helpful and the question has never been put.
What this is not
This is not an argument for banning the tools. The two mathematicians used Codex for a year and did serious work with it, and Ford’s problem last week was that it had too little institutional knowledge in its systems rather than too much.
It is not an accusation against OpenAI. The denial is clear and there is no evidence contradicting it, and the admission that follows is arguably a more honest answer than most vendors would give.
And there is a further allegation in this story, about a co-author being pressured over his affiliation, which OpenAI disputes and which I am deliberately leaving out. It is not established, and the useful part of this needs none of it.
One more thing worth noting
OpenAI’s own announcement could not be read for this piece. openai.com has returned a 403 error to us for three weeks. Everything above comes from Fortune’s reporting, from Simon Willison’s write-up, and from Buckmaster’s own signed statement hosted at NYU.
That is worth stating rather than hiding, and it is faintly relevant to the theme: the company at the centre of a story about what you can and cannot find out is one whose own pages we currently cannot open.
The sentence stands regardless. They cannot rule it out. Neither, probably, can yours.