OpenAI to Use Cybersecurity Data for Model Training Without Consent

OpenAI announced on November 29, 2025, that it will use session data from its cybersecurity program 'Daybreak Blue' for AI model training. The issue was that the company stated it would use this data even if users had disabled learning usage in their settings.

Daybreak Blue is a program offered by OpenAI for cybersecurity experts and researchers, where participants conduct sessions on advanced threat analysis and defense techniques. Such sessions often contain sensitive business data and unpublished insights, and participants appear to have believed that these would be excluded from training data. The policy change therefore drew criticism for betraying user expectations.

In response to user backlash, OpenAI sent a follow-up email promising to establish a separate opt-out mechanism for this training usage. However, users who had already enabled opt-out settings now face the need to go through procedures again.

This issue overlaps with another controversy that occurred previously. Earlier, a group of mathematicians raised suspicions that OpenAI may have used unpublished research findings for training without authorization. At that time, similar discussions arose about whether data was being used without consent, and this current incident echoes those concerns.

Large amounts of data are required for AI model training, and specialist domain data is particularly valuable as high-quality training material. Conversely, using data beyond user-set restrictions is framed as a fundamental issue of trust. The situation of 'it was used despite being disabled' is not merely a configuration error but raises questions about whether user choices are actually being respected.

Key points going forward include how OpenAI will establish its opt-out mechanisms and fulfill its accountability to users. Data usage transparency in AI services is increasingly scrutinized by regulators and users, and how such policy changes are communicated and how consent is obtained may become a catalyst for questioning industry-wide practices.

Data collected by specialist domain-specific programs often contains information beyond the scope of typical terms of service. In security-focused programs like Daybreak Blue, the confidentiality of information brought by participants can be particularly high, and discussions about the scope of training usage are expected to continue.