OpenAI's Navier-Stokes Dispute: Who Can Read Your Prompts?

On 8 September 2026 OpenAI announced that around 10,000 of its agents had produced a resolution to the Navier-Stokes problem in 88 hours. Two mathematicians who had been working on the same problem, using AI tools including OpenAI's own, questioned whether their unpublished work had informed it. OpenAI denies seeing that work, and says in the same announcement that data derived from their usage may have helped improve its models. Underneath the mathematics, the dispute is about what happens to the work you bring to an AI product, and about why "nobody read your prompts" turns out not to settle it.

Table of Contents

• What Happened With OpenAI and Navier-Stokes
• OpenAI's Position
• Access and Training Are Not the Same Thing
• Why "We Didn't Look" Isn't "We Couldn't"
• What This Means for Unpublished Work
• The Case for Private AI
• If You Still Need Frontier Models
• Common Questions About the Dispute

What Happened With OpenAI and Navier-Stokes

Tristan Buckmaster, a mathematician at NYU, and a researcher at Anthropic had been working on the three-dimensional Navier-Stokes problem, one of the Millennium Prize problems. Like most people doing technical work in 2026, they used AI tools while they worked, including Claude, OpenAI's Astra model and Codex.

OpenAI published its own resolution on 8 September. By its account, it launched the effort on 1 September after hearing rumours that others were close, ran around 10,000 concurrent agents, and reached a result 88 hours later. It has said it will not claim the million-dollar prize.

Buckmaster then questioned publicly whether his unpublished work had informed that result. OpenAI denies it. Parts of what followed are contested, including allegations about authorship that OpenAI researchers have rejected outright, and this post takes no position on those. (The Guardian, Engadget)

A note from the author. SayGm offers both frontier models and private open-weight models that run inside an enclave, and there is a real place for each. Which one a given piece of work belongs on is worth thinking about, and this dispute is a good moment to do it.

OpenAI's Position

OpenAI's announcement says the researchers and the agents "did not see any of their work through any means until they released it publicly" and that "no specific user data was accessed in order to solve this problem."

A few lines later it adds: "While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models."

The same announcement addresses the overlap directly. In a section on concurrent work, OpenAI says: "Our proofs differ significantly and even the precise results proved are different in the Euler case (forced vs unforced)."

These quotations are taken from OpenAI's own announcement of the result, On the Navier-Stokes Millennium Prize Problem, published 8 September 2026.

Work can reach a model through training data without anyone opening a session, which is what the second sentence leaves open. If OpenAI's account of the proofs holds, the dispute may resolve on the mathematics rather than on the data.

Access and Training Are Not the Same Thing

Buckmaster has described asking OpenAI whether Codex models had been trained on, or had access to, his sessions. By his account, the answer he received was about access: the model did not look up user data. Whether his sessions were used in training is the part he says stayed open.

That distinction is worth carrying into any conversation about a provider's privacy terms. "We didn't access your account" and "your work didn't train our systems" are two separate claims, and it is easy to hear the first and assume you have been given the second.

Why "We Didn't Look" Isn't "We Couldn't"

Every privacy assurance from a major AI provider is a policy. Policies are written by companies, interpreted by companies, and changed by companies.

That matters most in exactly the situation Buckmaster was in: work that is worth something precisely because it is not public yet, fed through a tool owned by someone who might later compete with you on it. A retention policy states what a provider intends to do, which is a separate matter from what its systems are able to do.

This is why the distinction between "we won't read your prompts" and "we can't read your prompts" matters more than it looks. The first describes behaviour and the second describes capability, and capability is the only half an outsider can verify.

What This Means for Unpublished Work

Most people reading this are not solving Millennium Prize problems. The exposure works the same way at every scale.

If you paste a proprietary codebase into a coding assistant, you are trusting a retention policy. If you draft an unfiled patent application, work through an unannounced architecture, or debug a system nobody outside your company has seen, the same applies. The work is valuable precisely because it is not public yet, which is the window in which a policy is the only thing protecting it.

None of that means AI tools are unsafe to use. It means the question worth asking is narrower than "do I trust this company." It is: what could this company do with what I send, if it wanted to, and can I check the answer myself?

The Case for Private AI

Private AI, also called Private Inference is usually sold as a protection against leaks and breaches. The Navier-Stokes dispute points at something narrower and harder to insure against: a provider could keep every promise it made, never read your session, and your work could still end up shaping its models. No policy covers that, because no policy would have been broken.

When inference runs inside a trusted execution environment, the prompt is decrypted only inside a sealed region of the processor, and the operator of that machine cannot read it. Not "does not". Cannot. The chip signs a measurement of exactly what code is running, and a client can check that signature before sending anything. When there is no readable copy of your prompt, there is nothing to train on, nothing to retain, and nothing to disclose later.

That is what SayGm is built on. Its confidential-tier models are open weights running inside the enclave, so the prompt is hidden from the model maker, the host and SayGm alike, and the tier is a field in the API rather than a claim on a page. Our guide to LLM gateways and why attestation matters covers how that check works, and the privacy model documentation sets out which tier carries which guarantee.

If You Still Need Frontier Models

The result OpenAI published is a serious piece of work, GPT-6 Astra is a strong model, and for plenty of tasks a frontier model is the only thing that will do the job.

Once you have decided a frontier model is worth it, you are no longer asking whether anyone receives your prompt, because the model maker has to receive it in order to reply. You are asking how many other parties receive it on the way.

That leaves two clean options. Go direct to the model maker, and the only party in the path is the one you chose. Or use a gateway that cannot read what passes through it, which adds a hop without adding anyone who can see your prompt. The one to avoid is a gateway chosen on price alone, because a cheap rate tells you nothing about who can read what passes through it.

SayGm carries OpenAI's models, including Astra, alongside Claude, Gemini and a set of open-weight models that run inside the enclave. It is a gateway, and it sits in the path the same way any other one does. The difference is that the route runs inside the enclave, so SayGm, the host and the network operators are sealed out of it. The provider you picked still receives the prompt under its own terms, which is the part you accepted when you picked it. Only a model running inside the enclave is hidden from its maker too, and both are real guarantees rather than the same one.

Common Questions About the Dispute

Did OpenAI use the mathematicians' unpublished work?

OpenAI says it did not. Its announcement states that no specific user data was accessed in order to solve the problem, and that its proofs differ significantly from the concurrent work. Buckmaster has questioned whether his work informed the result. Nothing has been established either way.

Does using an AI tool mean my work trains the model?

It depends on the product and the terms you are under. Consumer, API and enterprise terms usually differ on retention and training, and most providers publish a policy covering it. What a policy cannot tell you is what the systems are capable of, which is the distinction this dispute brought into view.

Can I stop my prompts being used for training?

Most providers offer a setting or a contractual term that excludes your data. That is a commitment, and for a great deal of work it is enough. A model running inside a trusted execution environment removes the possibility instead of committing against it, because there is no readable copy of the prompt to train on.

Is it safe to use AI tools on unpublished work?

For most work, yes. The judgement call is narrower than it looks: how much would it cost you if this particular piece became visible before you published it, and does the tool you are using make that impossible or merely promise against it.

If any of your work is worth protecting before it is public, that difference is the one to understand before you pick a tool. The quickstart takes a few minutes if you want to try either tier against something real.

About SayGm

SayGm is a drop-in inference gateway for teams who don't want to just take a company's word that their prompts are private. Every request is routed through a hardware-verified confidential environment - not even SayGm can see what's inside it. That's not a policy, it's provable. Swap in your existing OpenAI, Anthropic, or Gemini code and you're covered in minutes, at transparent, published rates with no hidden markup.

Say gm to AI at saygm.com.

Website | Twitter | Discord | Blog | Medium | Docs