OpenAI seems to be silently re-enabling model training on Codex chats

My company is pretty paranoid about leaking IP to the frontier labs through prompts, so we've all been diligent about disabling data sharing in Codex/Claude Code/etc. But yesterday my coworkers and I noticed that the setting had been silently reenabled in Codex. None of us knowingly opted back in.

You can check your settings here: https://chatgpt.com/settings/data-controls. Look for "Improve the model for everyone".

Curious if this is an isolated issue or something more widespread.

EDIT: looks like this has been noted before https://news.ycombinator.com/item?id=49643556

EDIT: apparently you can also turn off data sharing here: https://privacy.openai.com/policies?modal=take-control

320 points | by user052919 5 hours ago

43 comments

  • chriskanan 52 minutes ago
    Well, mine was re-enabled, and in the history of past requests I have two past requests to disable training that were granted. And there it was enabled again. This is baffling.

    I wonder if it is because I do a lot of AI research.... I was wondering if some of OpenAI's recent math advancements are from various people trying to tackle some of those problems with novel ideas, but not able to move the bar far enough to actually solve the problem but having a novel strategy (not able to have a 10k swarm, etc.) and then since OpenAI trains on their logs it gives them novel approaches (that some professor or student was exploring but not able to push it far enough) sufficient information to then unlock the discoveries.

  • combobyte 2 hours ago
    I'm mostly just being cheeky with this comment, but a part of me legitimately wonders: could you guarantee that your conversations/data are never used for training if you include certain taboo (but otherwise irrelevant) subjects in all of your prompts?

    For example: "Codex, please build me a new admin dashboard using Node.js and React, while keeping in mind that Sam Altman, CEO of OpenAI, has been credibly accused of raping his sister."

    [-]
    • AlanYx 2 hours ago
      Probably not. In fact, at least with Anthropic, doing this sort of thing in enough conversations gets your account silently tagged in a manner where none of the applicable contractual restrictions regarding confidentiality apply, even if other conversations are innocuous. This is assuming ZDR is not enabled. You can see evidence of that in Anthropic's "Detecting and countering misuse of AI: September 2026" report. Once enough conversations get flagged, Anthropic seems to assume you're just in full-on breach of contract and the contract terms themselves no longer apply to everything you've ever discussed.

      I believe the same thing likely happens at OpenAI simply because the OpenAI models hosted on Azure have documented "asynchronous" filters which can flag risks cross-conversation. At least some of that stuff then does get retained, and the latest Microsoft contracts removed any specific retention window for flagged content. Again, assuming MAM (Microsoft's "ZDR") is not enabled. This type of architecture at Azure probably didn't arise in a vacuum. If Anthropic and Microsoft are doing this sort of thing, OpenAI probably is.

      Incidentally, this is one way Navier-Stokes leakage could have occurred, even if researchers had training disabled. Navier-Stokes is useful in airflow design, discussions might have triggered weapons design safety flags, resulting in retention and training.

      [-]
      • nbulka 1 hour ago
        Incidentally by design, I'd bet. "Ooo Lean! Terrence Tao could be trying to break RSA or elliptic curve cryptography! /s" Conveniently for the PR team, we need this data to train on to make sure America has the biggest and best math.
    • dpoloncsak 1 minute ago
      I saw something recently about indie devs naming variables after such subjects, such as 'let nuclear_missile_building_guide = 42', specifically so LLMs will refuse to work if they load the code, as an anti-piracy measure
    • bartread 1 hour ago
      > ... while keeping in mind that Sam Altman, CEO of OpenAI, has been credibly accused of raping his sister."

      He what now?

      EDIT: I did a quick Google. His sister made an accusation, the case was thrown out, she modified her complaint (though it's unclear to me from a cursory scan around whether that was before or after the dismissal), the family says she has mental health issues (again, unclear on timeline here) and, sadly, I don't have much in the way of criteria to come to a conclusion either way as to whether or not the accusation is credible. The fact the case has been thrown out suggests not though.

      [-]
      • NoahZuniga 26 minutes ago
        It was dismissed because it was passed the statute of limitations, so the fact that the case was thrown out doesn't really say anything about weather it happened.
      • rescripting 1 hour ago
        > The fact the case has been thrown out suggests not though

        A billionaire managing to get a case dismissed in the US legal system hardly suggests an accusation has no merit.

        [-]
        • bartread 1 hour ago
          Touche.

          I don't know enough about the US legal system to comment but there certainly does sometimes seem to be an element of "whoever has the most money to throw at lawyers wins".

        • cactusplant7374 53 minutes ago
          His sister claims all of the big social media companies are conspiring against her in an attempt to help Altman.
          [-]
          • combobyte 33 minutes ago
            It's not hard to imagine how a person who suffered legitimate abuse at the hands of one of the most influential people on earth could develop this kind of paranoia.

            It's only slightly harder to imagine that the tech oligarchy really is conspiring against her.

            [-]
            • rangerelf 1 minute ago
              To be fair the club is pretty small, I'm pretty sure they keep in touch.
        • neya 33 minutes ago
          So, if you were accused of raping someone, you should just suck it up and go to jail and just because you have money, you are guilty, right? Not supporting Sam here, but this kind of thinking sets a dangerous precedent.
      • esseph 1 hour ago
        > He what now?

        Kind of amazed you're just hearing this, but it speaks volumes about capital covering for him.

        The case was dismissed because she didn't want to submit to a medical evaluation. This is extremely common for chronic rape victims.

        https://www.thenerve.news/p/sam-altman-annie-altman-sexual-a...

      • kotaKat 1 hour ago
        > This isn’t the only legal case Annie has been fighting against Sam and her other relatives in recent years. She also successfully sued the family over money left by the Altman siblings’ late father, Jerry Altman, that the family withheld from her for several years.

        The family has a grind to pick against her and is defending their golden child.

    • frevib 2 hours ago
      Here are the nude pictures of my girlfriend in an unclosed envelope. I give it to you to keep. Pinky promise you will never look at it.
    • latentsea 1 hour ago
      Open weights are all you need.
    • poulpy123 1 hour ago
      They will just send your chat to the police or just ban you
  • jamienk 2 hours ago
    I didn't realize the Gemini makes it so that saving chats in your sidebar = sharing chats with Google for AI training. They obfuscate this with their dark-pattern "Gemini Apps Activity"

    > Keep activity

    > Keeping your activity lets you pick up chats where you left off anytime and helps improve Google services, including AI models. When this setting is off, Google still saves chats for 72 hours to respond to you and help keep Gemini safe.

    [-]
    • ZnerflBerp 2 hours ago
      I'm surprised they even feel a need to trick you. They have access to the data and more than enough motivation.
    • ipsum2 47 minutes ago
      Gemini is the worst at this - its impossible to opt out if you use AI Studio.
      [-]
      • NoahZuniga 25 minutes ago
        I thought that if you used an api key data wasn't trained on in AI studio
  • monster_truck 4 hours ago
    If your company actually cared about this they would be running their own inference instead of leaving fate to a couple of checkboxes.
    [-]
    • lukeschlather 2 hours ago
      Yeah, why didn't I think of just spending $30k/month on an inference server and figuring out how to train a 2T parameter model. I clearly don't care about this at all or I would just do that.
      [-]
    • user052919 4 hours ago
      fair enough, but I still think it's an ethical issue for the model providers to silently reenable training after people have explicitly opted out
      [-]
      • monster_truck 4 hours ago
        It didn't happen to me, nobody I know seems to have experienced this. How can you prove to us that you ever toggled it off in the first place? This is a pretty serious accusation to make so blindly
        [-]
        • user052919 3 hours ago
          Not an accusation! Just seems like it's happening, which is why I wanted to post this to ask if others noticed the same thing. I definitely can't prove it. If it had just been me I would have assumed I forgot to turn it off. But the fact that my coworkers noticed the same thing made it suspicious. Also the linked HN thread suggested others have seen this happening too
          [-]
          • teekert 3 hours ago
            Fwiw I've had this happen with Mistral, I fell right in the middle of them changing from opt-in to opt-out AND removing their org-wide dial (on the Teams plan). They reversed that last decision (the org-wide dial returned) about 48 hours later, but in the process they turned all sliders for all my staff back to "on". Not sure if it was all malicious (I think not, just a very crappy move that hit our trust in them pretty bad). After some emails they ensured me they stored no data for training. But strange things happen.
        • novaRom 2 hours ago
          Maybe it's a "dark pattern" embedded into UI, like what Google does with their Photos app - chances are you or your kids accidentally will click a toggle "Enable Backup", so later your free Gmail will stop working because of "no more space left".
        • latexr 2 hours ago
          Friend, there’s no need to be so combative. OP didn’t make an accusation, they observed something and made a conclusion which may be wrong or right, then came on HN to say the thing seems (key word that they used) to be happening and asking if anyone else has experienced it to test the theory and act accordingly.

          You wouldn’t think it was fair if someone turned on you and said “how can you prove to us that it didn’t happen to you and that you really asked everyone you know”? That would be silly, right?

        • lirolero 3 hours ago
          [dead]
    • rs999gti 4 hours ago
      Agreed. Azure, GCP, and AWS have gated models that only exist in their infrastructures and can't dial out unless yous give them permissions to do so.

      Don't use a models only company if you need enterprise level security and data protection.

    • sanex 2 hours ago
      Yeah but how expensive is that vs $20 or 100/month subs?
      [-]
      • nozzlegear 2 hours ago
        How much are your company's secrets and proprietary information worth, and how much would it cost to have them leak? You'd need to put a number on that before you could complete the calculus.
        [-]
        • aleph_minus_one 1 hour ago
          On the other hand (in particular for smaller companies particularly not in the USA): How much can you afford to pay? Can you actually afford the self-hosted route?
    • 20k 2 hours ago
      Its astonishing that anyone thinks that these companies even respect the checkbox. These are some of the objectively scummiest companies on earth that have violated nearly ever copyright law we have
  • bitbasher 1 hour ago
    Even if you disable data sharing and training, there are plenty of greasy methods they can use to train on your chats without “training on your chats”
    [-]
  • kevcampb 2 hours ago
    Last week Claude seemed to trigger /feedback automagically in a session, even though we've got that turned off in our org settings. Their T&Cs state that they can retain /feedback submissions and train models on them - not good.

    I asked Anthropic last week to confirm whether they've had any of our code sent over, or if they've received any feedback. They've stopped responding to my support requests.

    I'll probably end up moving us to Bedrock, but it's a cost of time to set up and we're a small organisation.

    [-]
    • l1n 2 hours ago
      I think this is the new Claude Code in-session suggestions for feedback - I think they generate in-session even though they're unsubmittable for the org. Kind of bad UX.
      [-]
      • nbulka 1 hour ago
        The absolute worst and the reason I switched from Anthropic to Codex. Codex caught wind of it of course and now they do use the unsuspecting message: We are reviewing this request (do you mean hoping to train on it? or reviewing?) and if you would like to use a different model, press the "any" key. I wonder if they collect the data they make a point to collect, that would make so much sense ... we need to speak out against these type of data collection patterns. Terrible UX and a dark pattern for them to use the same "accept" buttons of 1, 2, 3 etc. The irony is that THESE feedback messages are the sole thing driving me to consider running open source models locally.
  • hoppp 45 minutes ago
    Do not use frontier labs products if you want to avoid leaking IP

    host your own models. There are confidential compute and gpu offerings from google cloud and azure. Pay as you go, rent your own GPU and host your own models there.

  • 1239715 3 hours ago
    Disabling "improve the model" is one thing. Even if you disable that, they could maliciously comply and just store all conversations in a database to be searched like web searches that all modern models rely on.

    Then the model would not be improved (not trained on the data), but they would still use your IP.

    Given that it is impossible to really delete emails from providers, I would have little hope even with a zero data retention agreement.

    [-]
    • ericskiff 3 hours ago
      My personal view on this is that there are enough people who need this to not be happening or who would be very happy to catch any of the major frontier model providers fibbing about it, that needles are constantly being added to the haystack and searched for in subsequent models and requests made to them.

      Proof of training or RAG search on data that was private would be a huge smoking gun and would change usage habits overnight.

      [-]
  • liendolucas 26 minutes ago
    To be more clear these are today's company policies:

    https://m.youtube.com/shorts/TfT4v4iICCk

  • tempestn 50 minutes ago
    I assume it only takes slipping on this briefly and they essentially have your entire code base?
  • sshah03 2 hours ago
    I wouldn't be surprised if, in the future, a lot more companies (especially in knowledge work industries) see it as too risky to allow their employees to send as much data as they have been to OpenAI/Anthropic. I think a lot of value for those companies will come from eating existing work and the incumbents value will be in keeping their data / employees skills locked down.
    [-]
    • esikich 2 hours ago
      They already do. Outside of tiny companies the norm is block all AI across the board if they have the IT staff that knows how. From what I've seen, large enterprise companies are still testing the waters outside of dev/IT use.
    • cyanydeez 2 hours ago
      it's actually fascinating that so many corporations are just willing to give up their entire intellectual properties, real & imagined, to a third party because it might let them remove a percent of their work force. Especially when told "it can do it", and they dont fill in the "without you".

      I've no doubt, Palentir's forward deployed engineers will essentially operate like the borg and turn companies into defacto subjugated properties.

  • alex_hirner 1 hour ago
    As ML practitioner it's quite obvious that the current advantage of Anthropic is sourced from the 30 or something days it collected essential code/prompt data during the Fable rollout.
    [-]
    • user43928 1 hour ago
      How would you use such noisy data in a way that brings a large advantage over a pipeline of curated tasks?
      [-]
      • alex_hirner 48 minutes ago
        You have to figure out messy real life tasks anyway (ambiguous reward signal, inconsistencies, variables outside the observation).

        Having actual data just makes it more feasible.

  • hendler 46 minutes ago
    Mine has remained off. Consider using "Export data" and examine your local cache. If you are in a large co., you can monitor this way.
  • vibranium 3 hours ago
    If you really care, sign a ZDR contract with OpenAI or use Bedrock or something.
    [-]
    • rglullis 3 hours ago
      If you *really* care, run your own inference. Everything else is just wishful thinking and/or convenience winning over self-sovereignty.
    • gizmodo59 2 hours ago
      you cant do it for personal subs with oai or ant no?
  • ghempton 2 hours ago
    We've noticed this occasionally and its a pretty serious issue since we tell our customers that none of their data is being trained on. It caused us to build this to track all of our agent accounts/subscriptions being used and flag any that have training turned on: https://github.com/codealong/codealong
  • throwitaway222 1 hour ago
    Seems like if want this you need to use a frontier model through GCP or AWS if you really want to avoid training
  • bentt 4 hours ago
    Don't trust this company.
  • impossiblefork 2 hours ago
    Surely the solution to this kind of thing is to sue or make police report, or at least to have ones lawyers contact theirs?
  • christimmerman 1 hour ago
    Wouldn't be surprised, could be a coding error? If you want to give them the benefit of the doubt?
    [-]
    • geauxvirtual 52 minutes ago
      > ...could be a coding error? If you want to give them the benefit of the doubt?

      Why are there any errors in the generated code?

  • edot 4 hours ago
    Turn on advanced account security. You should be doing this anyways (requires hardware keys). But it also locks data sharing off.
    [-]
    • tom1337 4 hours ago
      Unfortunately, they are also changing that a bit:

      > Thank you for using Daybreak Blue and for being part of our Trusted Access program. We are reaching out to notify you of an upcoming change to how your Daybreak Trusted Access data may be used. Daybreak use requires you to enroll in Advanced Account Security, which turns off the “improve the model for everyone” setting. However, from November 29, we may use content from Daybreak Blue sessions on personal accounts to improve our models, including to help strengthen safeguards against cyber misuse. We will use Daybreak Blue interactions for these purposes, even when the “improve the model for everyone” setting is off.

      [-]
      • dstu 2 hours ago
        Wow, I’d been contemplating signing up for the Blue program, but using it as an opportunity to opt people back in to training is pretty underhanded. I guess I’ll be sticking to the friendly neighbourhood Chinese guy in a trench coat whenever I want to do any security work.
      • edot 3 hours ago
        Interesting. I am not in Daybreak so this isn't an issue for me right now, but points to one more reason to switch away from Closed AI and Anthropic.
      • gizmodo59 2 hours ago
        They sent a follow up email saying you can opt-out
  • apt-apt-apt-apt 3 hours ago
    Or my other favorite move, the quiet new little guy in settings.

    E.g. "Allow ABC to transmit, log, and track your every move? ON" Hey, when did this little guy get here!

  • slop 3 hours ago
    This isn't exactly relevant, but something I like about T3 code is that they'll fix stuff quickly that anthropic or open ai mess up in their harnesses.
  • tiffanyh 2 hours ago
    Unchanged for me (disabled/off)
  • hsuduebc2 43 minutes ago
    You should assume that they are training on their data even when it's disabled by you. None of these companies prove that they are worthy of any trust. If they got caught then they receive a fine which would be a droplet in their massive budget. They don't have really big incentive to be trustworthy.
  • TechRemarker 1 hour ago
    Mine is still set to off.
  • hyperbovine 3 hours ago
    Never ascribe to malice that which can be explained by stupidity.

    The quality of their software is such crap and this is probably just some vibe coding mishap. Go read the Github issues for Codex CLI for example -- robots talking past other robots. I am 99.9% certain not a single human being has a deep understanding of what is going on with the Codex app anymore.

    [-]
    • digitaltrees 2 hours ago
      That quote isn't reasonable when there are profound economic incentives to do the malicious thing.
    • noir_lord 3 hours ago
      They do kind of have to eat their own dogfood (or at least pretend to publically), you do wonder if they'll be an interesting public example of choking on that dogfood at some point.
      [-]
      • rfgplk 3 hours ago
        The frontier labs are entirely AI generated at this point. By entirely I mean ~100% of the code and supplementary training pipelines are AI created, with ZERO human guidance or oversight. And compare the results, look at Opus 5.5 vs the original Opus (which was human made). See the difference?

        In fact, my personal prediction is that OpenAI and Anthropic will let go of all their human employees by Q1 2027.

    • tacone 3 hours ago
      Malice and stupidity reinforce each other. If you find yourself unable to determine which one is causing the issue, run.
    • rfgplk 3 hours ago
      > 99.9% certain not a single human being has a deep understanding of what is going on with the Codex app anymore

      Because humans actually don't have the ability to.

    • dan_thinks 3 hours ago
      [flagged]
  • kian 2 hours ago
    can confirm. this should be illegal behavior.
  • _doctor_love 4 hours ago
    When you think about it, it's really terrible for your training data to be sitting on your machine uningested. It ought to be centrally located. You know, for the greater good.
  • kylehotchkiss 2 hours ago
    I was just in my settings telling codex to stop trying to browser use Safari (ugh) and noticed that model training was enabled. Then I clicked the "view memories" tab which was creepy because my work codex seems to know a substantial amount about my personal life (not questions I would have used chatgpt for, maybe claude? is it watching my screen? idk)
  • m3kw9 2 hours ago
    mine wasn't reenabled
  • spwa4 4 hours ago
    OpenAI is also now hiding your usage. Not accessible anymore in the menu, and /usage in the codex app now also gives a lot of stats, but the one stat you do want to know, how much limit left, is no longer there.

    I'm guessing another big usage reduction is coming soon.

    [-]
    • wisemanwillhear 3 hours ago
      Mine got move out of the user menu on the lower left to just above the user menu as it's own clickable selection. The other day, I though they took the old quick view of usage away, and started going back to the settings to look. Turns out they just moved it.
    • pizza234 4 hours ago
      > Not accessible anymore in the menu, and /usage in the codex app now also gives a lot of stats

      Codex shows the usage limits on /status - Claude instead does it on /usage.

    • user052919 4 hours ago
      fwiw I can still see my usage in the Codex app
  • Ronaldotchio 3 hours ago
    [flagged]
  • Zyxel89 3 hours ago
    [flagged]
  • oxcartctl 3 hours ago
    [dead]
  • wzee-dev 2 hours ago
    [flagged]
  • tha_infra_guy 2 hours ago
    [dead]
  • ankur_misra 2 hours ago
    [flagged]
  • moeenmirza707 3 hours ago
    [flagged]
  • thewhitetulip 3 hours ago
    They said that they have millions of lines of PRs merged daily

    Pretty sure they don't know this has happened lol

    Maybe they'll raise a new PR with 1000000 lines to revert back now that you guys leaked the information

  • rfgplk 3 hours ago
    You actually _want_ OpenAI to train their models on your code. This helps future models become far more effective for your line of work.

    > but IP

    There is absolutely nothing novel humans can come up (yes, doesn't matter who you are) that LLMs aren't aware of.

  • CEOatMindfries 4 hours ago
    May be the coding agents should build a layer when they don't leak any IP, treat them like environment variables, which must be handled deterministically.
  • novaRom 2 hours ago
    So, you are paranoid about leaking IP to the frontier labs, but you are using their remote black boxed services? What a solid logic.
  • rachr 1 hour ago
    This is one of the companies responsible for the theft of basically all human knowledge. There is no way I would trust confidential information with any of these companies.