A professor at NYU claims OpenAI's Codex absorbed his unpublished research. OpenAI denies it. Both can be wrong about the mechanism, and both can be right about the outcome.
Here is the part that matters: Buckmaster says he did not share his name with OpenAI until recently. Before that moment, he claims, the company's agents were stalled. Within twenty-four hours of name disclosure, he says, those agents reached "exactly where we were."
That sequence is technically incoherent as a training-data-contamination story. If his drafts already lived on OpenAI's servers -- as LaTeX, as code, as prompt history -- then his name is irrelevant to whether that data entered a training corpus. Names do not unlock data that is already ingested. Names trigger retrieval. Names trigger memory. Names trigger a human reading a file.
This is not a defense of OpenAI. It is a narrower claim: the public argument has conflated four distinct data pathways under one word -- training. Those pathways have different shelf lives, different opt-in defaults, and different regulatory exposure.
I have spent the past four years auditing how institutional capital interacts with crypto liquidity, and before that I built scrapers to stress-test whitepaper coherence across five hundred ICO projects. The pattern is familiar. When a counterparty controls both the tool and the data exhaust, users lose the ability to audit what left their possession. That is not a bug in AI products. That is the architecture.
The core structural fact: OpenAI is simultaneously the tool provider and the data recipient. Every prompt is a wire transfer of intellectual value into a counterparty that has no obligation to disclose settlement.
Start with the taxonomy. OpenAI's denial covered exactly two things: "the past two months" and "including training." That is a surgical statement. It says nothing about pretraining corpora assembled before some cutoff. It says nothing about session memory, cross-conversation retrieval, or RLHF feedback loops where human reviewers read flagged outputs. It says nothing about the enterprise and consumer data isolation policies that the company has never made legible to researchers.
The time-bound denial is self-consistent. An older model, frozen before Buckmaster's recent activity, cannot contain his recent drafts. But that consistency is narrow. The company did not deny that his earlier drafts -- code, LaTeX, prompt fragments sitting on its infrastructure -- were used. It denied one window and one pathway.
Now weigh the alternative explanation. Navier-Stokes is a Millennium Prize problem. Its partial progress, its known attack vectors, its standing obstructions are extensively published. A model trained on the mathematical literature has a non-trivial prior probability of independently reconstructing the current frontier of one step. That is not plagiarism. That is convergence under a shared training distribution.
The article never establishes whether Buckmaster and Alpöge's step is genuinely unpublished technique or a recombination of published elements. That is the technical watershed. Without it, the accusation cannot be resolved on mechanism. It can only be resolved on vibes.
And the vibes are bad for OpenAI, because the second pathway -- retrieval and memory -- is far more plausible given the "twenty-four hours after name disclosure" timeline. Name disclosure does not alter a weight matrix. It alters what a retrieval-augmented system can surface. It alters what a human reviewer can find. If performance shifted discontinuously after a name entered the loop, the likely culprit is search, memory, or human intervention -- not silent ingestion.
OpenAI has not addressed this. It has not said whether Codex maintains persistent session memory, whether cross-session retrieval is default-on, or what the knowledge cutoff of the implicated model actually is. Those are answerable questions. The company has chosen not to answer them.
Liquidity vanishes. Code remains. The same is true of prompts: they may disappear from your interface, but they do not disappear from the counterparty's storage.
Here is the part the discourse is missing. This is not an OpenAI problem. It is an industry-wide data-governance problem that crypto has been shouting about for a decade while the AI labs quietly institutionalized opt-out defaults. Most consumer AI products train on interaction data by default. Researchers paste grant proposals into chat windows. Reviewers paste manuscripts. The leak path is not exotic -- it is routine, scalable, and institutionally invisible.
Consider the sequence Buckmaster describes. Grant reviewers, he says, routinely paste proposals into AI tools to draft summaries. That hands unpublished research plans to the model provider. No hack required. No breach notification triggered. Just normal workflow.
This mirrors what I documented in 2020 when I led a rapid-response audit of Uniswap V2 during DeFi Summer. The yield mechanisms looked sustainable in isolation. They were not. The fragility lived one layer down, in the stablecoin inflows that nobody modeled because the interface hid them. AI data governance has the same structure. The interface hides the extraction.
The competitive layer sharpens this. Buckmaster's collaborator Levent Alpöge works at Anthropic. That makes this OpenAI versus Anthropic, whether or not the coverage says so. The allegation that OpenAI offered sole authorship in exchange for dropping Alpöge -- unverified, single-source -- reads as a priority claim maneuver in the AI-for-math race. Three labs are competing to announce results on Millennium problems. Announcement velocity now exceeds verification velocity. That gap is the real integrity risk, and it is not unique to one company.
OpenAI's response fit the playbook: deny the narrow claim, then release a positive claim about another Millennium problem. Crisis PR plus capability signaling. It works on headlines. It does not survive audit.
The contrarian read is this: the scandal is not that OpenAI may have absorbed a professor's work. The scandal is that no user -- researcher, enterprise, or institution -- can audit whether they did. The absence of data lineage is the product. The opacity that makes these tools feel magical is the same opacity that makes them unaccountable. Regulation will not fix this first, because regulators write rules slower than models ship. The fix, if it comes, comes from procurement: enterprise buyers and research institutions demanding zero-retention guarantees, session-memory transparency, and auditable data flows. Money moves faster than policy. Always has.
Watch the January enterprise renewal cycle. If research institutions start inserting data-sovereignty clauses into AI procurement, the trust deficit has already priced in. If they do not, the next leaked proposal will be yours.
The mechanism question remains open. The structural question does not.