According to The Decoder and emails posted by recipients on X and LinkedIn: OpenAI notified individual users of its cybersecurity "Trusted Access" program that starting 11 29, it would use Daybreak Blue session data to improve models, even if users had disabled the "Improve models for everyone" setting, whereas previously such data was not used for training. After backlash, OpenAI sent a second email apologizing for "confusion caused by previous communications," stating that after 11 29, Daybreak Blue users would still have a separate option to opt out of "using Daybreak sessions to improve models"; however, interactions flagged for security review may still be used for security purposes, such as improving anti-abuse measures, with more details to be released closer to 11 29.
Confidence: Medium (60) · Event time 2026-10-31
Reasoning
- Daybreak Blue provides vetted security researchers with models that have fewer restrictions; sessions often contain undisclosed vulnerabilities, exploit chains, and details of ongoing investigations. Once this content enters training, it could potentially be reproduced in other users' conversations.
- According to Yoav Alon, who posted on LinkedIn, enterprise and business accounts retain their existing protections, while individual accounts are affected. OpenAI's data controls page already states that Daybreak sessions from individual accounts may be used regardless of training settings.
- Researchers are concerned about a repeat of the controversy involving mathematicians Tristan Buckmaster and Levent Alpöge: after the two uploaded unpublished drafts on the Navier-Stokes equations to Codex, OpenAI quickly produced its own proof. OpenAI denied using their inputs for training.
Usage
- Daybreak Blue individual users: Watch for the opt-out method announced by OpenAI before 11 29 and configure it before it takes effect. For work involving undisclosed vulnerabilities, consider switching to an enterprise account or refraining from uploading until the rules are clear.
Risks
- openai.com refused access, so the original text of OpenAI's public policy could not be read. The content of the two emails comes from screenshots by recipients (the second email posted on X was read) and media reports; the original text of the first email has not been verified.
- How to set up the "separate opt-out option" and when it will go live have not yet been announced. The claim that enterprise accounts are unaffected comes from a LinkedIn post and has not been confirmed by OpenAI.
Open · OpenAI's second email posted by John Kelleher on X · Yoav Alon's LinkedIn post