> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Both

OpenAI says it may train on your personal Daybreak sessions, even with training switched off

By alkizz ·

OpenAI's Data controls help page has a new section called "Trusted Access on personal accounts," and it changes the deal for anyone using Daybreak Blue on their own account. In OpenAI's words: "During Daybreak sessions on your personal account, we may use content from your interactions to improve our models even when 'Improve the model for everyone' is off. This helps us to strengthen safeguards against cyber misuse."

The page has no date on it, just "Updated: 11 hours ago" when I read it early on Oct 31, which puts the edit around Oct 30. It doesn't give an effective date either.

OpenAI told Trusted Access users by email that the change starts Nov 29, 2026, that it doesn't apply to business and enterprise customers, and that it doesn't change how OpenAI handles data under Private Safety Processing (PSP) or Zero Data Retention (ZDR). No OpenAI public page gives that date or spells out that exemption yet, so the training wording itself is still only what's on the Data controls page, which separately says OpenAI doesn't train its models on business, enterprise or API content by default.

Daybreak is OpenAI's Trusted Access for Cyber program, and Blue is the tier that gives "reduced refusals on supported mainline models ... for verified defensive work in authorized environments." OpenAI lists the uses as vulnerability triage, secure code review, malware analysis, detection engineering, incident response and patch validation, which is pretty much the list of things you'd least want in someone else's training set. So people are annoyed, and they have a point. But the change is narrower than some of the reaction makes it sound.

What's actually confirmed

What isn't settled

The Advanced Account Security pages say the opposite. OpenAI's AAS help page, last updated about 11 days ago, still says "Conversations are not used to train OpenAI models while Advanced Account Security is enabled," with no Daybreak exception. The Apr 30 post introducing AAS sold "Automatic training exclusion" and says AAS conversations "will not be used to train our models." That same post said individual Trusted Access for Cyber members using its "most cyber capable and permissive models" would need AAS from June 1, 2026. So the people this change covers are the people OpenAI told, on two other pages, that their chats wouldn't be trained on. OpenAI hasn't said publicly which page wins, and as far as I can tell the AAS pages just haven't caught up yet, but that's a guess.

And a few things nobody has answered. OpenAI hasn't said publicly whether past sessions are covered or only new ones, what "content from your interactions" includes (files, tool outputs, Codex environments), whether Daybreak Red is covered, or how this content is filtered, kept or reviewed. It's also unclear whether someone with individual Blue approval who's also in a Business or Team workspace counts as a "personal account" here. OpenAI says workspace membership "does not exempt individual Daybreak Blue users" from the AAS and hardware-key rules, but it says nothing about training.

Is OpenAI taking researchers' work?

That's how several researchers read it, and some of it holds up. OpenAI's own wording overrides an explicit opt-out for exactly the kind of work that tends to be sensitive, and it did that on a quiet help page while its AAS pages still promise the opposite. Security researcher @seanhn, quoted by CellCog, put it far more harshly than I would, and predicted "It also will presumably kill Daybreak usage by security researchers." On OpenAI's community forum, one self-described Daybreak Blue user wrote, "I explicitly turned off model training for a reason. I don't understand why using Daybreak should override that choice," and another called it "a dirty trick" and said they'd be talking to their lawyer. On Mastodon, joy larkin summed it up as OpenAI "planning to use data from personal Daybreak Blue usage to train models, even if you're opted out otherwise."

But the strong version goes further than the sources. The page says "may use," the purpose it gives is cyber-misuse safeguards, and nothing public says past sessions are included or that anyone's findings get published, shared or reused outside training. It also only reaches individuals on personal accounts, not every researcher and not enterprise customers. One caveat on the sources: CellCog sells AI agents that run on a competitor's models, and it says so.

What it means

OpenAI does have a track record of accusations about research theft. One example that jumps out is the recent math battle that erupted a few weeks ago, when OpenAI "solved" a very hard math problem that actual mathematicians were also working on using OAI. That's weird timing, I'd say. Regardless, frontier models stealing research and using it to "improve" training may just be a way to "improve" margins. I do think it's something to worry about if you're doing sensitive research with client data, building proprietary detection methods used in your SOC based on confidential client data, or using client IRPs to do AI-assisted tabletops and so on. Anyway, the labs have demonstrated they think security = finding vulnerable software + patching. If you can do your stuff with an open local model, just do that. Daybreak is a cool program, but maybe not as cool as before now that they want to peek into stuff you'd rather not allow.

The score

I'd call it a 2, mostly calm. It's a data-use policy change, not a vulnerability, so nothing is exploited and no attacker gets access to anything. It only covers Daybreak sessions on personal accounts, and OpenAI already documents how to switch Daybreak off per session. It isn't a 1, though, because the wording does override an opt-out people chose on purpose, and the AAS pages that promised training exclusion haven't been updated. If you use Daybreak Blue on a personal account for client work or anything under embargo, treat yourself as a 3.

What to do:

Sources

Related

On the checklist

More briefs

← All briefs