The setting that decides who owns your next idea

In this issue

The lead — your R&D, a toggle, and trade-secret law
Breach Brief — Miljödata: one supplier, one Swede in five
Governance Briefing — 53 images nobody can return · no global regulator coming
Where AI Makes a Difference — a Millennium problem, checked by software
Since the last Memo — two new pieces on fredriklindstrom.info
The Governance Game — who decided what goes into the tool?

On 8 September, OpenAI was asked a question about its own product that it could not answer on the day.

Tristan Buckmaster, a mathematician at NYU, and his collaborator Levent Alpöge had spent the summer working on fluid-dynamics problems with AI tools, OpenAI's Codex among them. When OpenAI announced that its agents had solved a version of the Navier–Stokes problem (the capability story is in the last section of this issue), Buckmaster asked in public whether the model had been trained on, or had access to, their Codex sessions. "I do not know whether our data was used," he said.

OpenAI's answers moved over three days. First, that no person and no agent had looked at user data for the effort. Then, in a statement to reporters: "while unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models." By 10 September it had gone further, calling it "impossible for Dr. Buckmaster's Codex prompts over the last two months to have influenced the system in any way." Earlier prompts were not addressed.

Look at what that sequence tells you. One of the best-resourced research organisations in the world needed two days to say, from its own records, whether one customer's unpublished work had shaped its product, and even then it could vouch only for the last two months. Nobody has shown that anything improper happened. For a board, the lesson sits elsewhere: the question had no ready answer.

Now replace the mathematician with your head of R&D.

The answer turned on something most boards have never asked about, which is the kind of account. OpenAI's published policy excludes business workspace data from training by default, Codex included. Consumer ChatGPT and Codex content may be used for training unless the user switches it off in a settings menu. Nobody has said publicly which kind Buckmaster used, and the phrase "private session" does not settle it. So the protection around a piece of unpublished work came down to a toggle, set by one person, on an account his employer may never have seen.

In my experience, that toggle is how most organisations govern their AI tools today. Engineers paste code into whichever assistant is fastest. Strategists draft the board paper in a personal subscription because the corporate one took six months to approve. The policy says not to. The policy is a compliance artefact; it is what you show an auditor.

The business tier is safer, and it is still a setting. On some plans an administrator can opt in to sharing data with the vendor, and in most companies nobody outside IT would know if they had. A contract clause tells you what the vendor promised. Only the configuration tells you what is switched on, and very few boards have seen it.

De-identification is the word that makes this sound safer than it is. De-identification removes your name. It does not remove your idea. A proof strategy, a chip layout, a pricing model and an unreleased molecule are just as useful to a model with the author's name stripped off.

There is no undo, either. Once a session has gone into a training run, there is no practical way to pull one customer's contribution back out of the model. A deletion request removes the transcript. What the model learned from it stays.

Here is where it becomes a fiduciary question. Trade-secret protection depends on the owner having taken reasonable measures to keep the information secret: the Defend Trade Secrets Act says so in the United States, and Directive 2016/943 requires "reasonable steps" in the EU. If a competitor ships your idea next year and you go to court, the first thing opposing counsel will test is what you did to protect it. A policy nobody enforced, on accounts the company did not own, is a weak answer. A record of which tools and which settings, checked by whom and on what date, is a strong one.

Ask four questions at the next board meeting.

Which AI tools are our engineers and strategists using for unreleased work, and on whose account?

For each one, is our data excluded from training by contract, or by a setting an individual can change?

Who, by name, owns that answer, and when did they last check it?

If a rival shipped our idea next quarter, could we show within a week what went into which tool?

None of this means banning the tools. Buckmaster's own results came out of them, and the people doing your most valuable work should be using AI hardest. The labs will keep getting better at learning from whatever they are given. The board's job is to know that someone at the company decided what to give them.

Records on 2.2 million people, about one Swede in five. The regulator's fine came in close to the ransom the attackers asked for.

In late August 2025, attackers broke into Miljödata, a supplier of HR and sick-leave systems used by around 80 per cent of Sweden's municipalities, as well as state agencies and private employers. They demanded 1.5 bitcoin, roughly $168,000 at the time. The data was later published on the dark web under the name Datacarry: personal identity numbers, contact details, sick-leave and rehabilitation records, and school incident reports involving children.

On 22 September this year, Sweden's data protection authority, IMY, fined Miljödata SEK 1.8 million, about $183,000, under Article 32(1) of the GDPR. The findings name two controls any competent audit would test. The company did not check new software properly before installing it, and it had no automated, real-time monitoring to detect intrusions. According to SVT, the way in was an outdated firewall component from another vendor, installed about a week before the attack and carrying known vulnerabilities. IMY has also opened examinations of two municipalities and one region.

That last sentence is the one for directors. Under the GDPR the municipalities are the controllers; Miljödata processed the data on their behalf. They outsourced the processing. They kept the accountability, and the regulator is now asking what they did to check.

Almost all of them will have had a data processing agreement. That is a compliance artefact. It is what you show a regulator. It does not tell you whether your supplier would notice an intruder, and on IMY's findings this one would not have.

Caremark and Marchand do not ask whether a supplier was breached. They ask whether the board had a system to know. Build the question from your own estate. Name the supplier that holds the most sensitive data on your people, such as payroll or sick leave. What has your board seen about it? A certification and a signed agreement, most likely. Neither is evidence that anyone is watching that system tonight.

Now run the same test on the suppliers you added this year. Every AI vendor you use is a processor too, and its agents act on your data. OpenAI's own post-mortem of the Hugging Face compromise says chain-of-thought monitoring "would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems." That monitoring was not running. It is the control IMY found missing at Miljödata, one layer up the stack.

Ask this: for the supplier holding our most sensitive employee data, and for our largest AI vendor, what evidence (not assertion) shows they would detect an intruder today, and when did we last see it?

If your data was eligible for training, it was inside the blast radius. On 25 September, OpenAI disclosed that its agents had posted 53 images uploaded by ChatGPT users to image-hosting sites, behind unlisted links. The images came from consumer users who had not opted out of model training, and they sat in research environments the agents could reach. Business and enterprise data is excluded from training by default. OpenAI says it cannot tell the affected users, because its privacy approach prevents it from reassociating de-identified images with the people who supplied them. It has also notified dozens of third parties, including governments and universities, about other agent activity, and says the investigation could take months. Sam Altman's account of the delay: "We have not been as fast as we would have liked but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs." Two things follow for a board. The training opt-out now works as a security control, whatever the settings page calls it. And de-identification, which protected these users' names, is also the reason nobody can tell them.

Do not plan for a global AI regulator. On 23 September the UN Security Council heard from the heads of OpenAI and Anthropic. Sam Altman said decisions "cannot be made by labs in San Francisco alone." Dario Amodei said: "If managed poorly, I even believe AI could be a risk to humanity." Michael Kratsios, speaking for the United States, closed the door in the same session: "We totally reject all efforts by international bodies to assert centralised control." (Quotes as reported by Al Jazeera.) The labs asking for rules makes the headline. Washington refusing them decides your compliance plan. The rules your company will operate under are the ones already written: the EU AI Act, with labelling duties from 2 December 2026 and stand-alone high-risk systems from 2 December 2027, US state laws, your sector regulators and your own contracts. A board waiting for those to converge has chosen to comply twice.

Since 2000, a $1 million prize has sat on the equations behind every wing and weather forecast. On 8 September, AI agents claimed the answer and declined the money.

OpenAI says about 10,000 of its agents, running an unreleased model for 88 hours, proved that the Navier–Stokes equations can break down: a smooth fluid, pushed by a smooth external force, develops a singularity in finite time. That is the company's own account. No independent review is complete, the version with no outside force is still open, and on 11 September the Clay Mathematics Institute said the problem "has apparently been settled" while calling its own review process "deliberately unhurried." The credit is disputed, as the lead sets out. Buckmaster, whose own results landed hours earlier, still wrote: "This is a Deep Blue-Kasparov moment."

The more useful fact is how the answer got checked. The agents also wrote the proof in Lean, a language in which software verifies every step. Nobody has to trust the model (or the company) to know whether the logic holds. What is left for humans is narrower: did the machine prove the question that was actually asked?

So why does this problem matter? The Navier–Stokes equations describe how air moves over a wing, how blood moves through an artery and how a storm crosses an ocean. Engineers solve them numerically every day, and nothing in their simulations changes on Monday. The proof answers a deeper question: whether the equations themselves can produce nonsense, an infinite speed from finite energy. For 26 years the best mathematicians alive could not say.

The larger shift is in the kind of problem now falling. In May, OpenAI said one of its models had settled an Erdős problem that had been open for about 80 years. This one sits on the short list of problems mathematics formally calls its hardest, and the attempt took 88 hours and a compute bill that outside estimates put in the millions of dollars. Until this year, an attack on a problem like this cost a career, and most attempts failed quietly. Once an attempt costs a budget line, the question every research organisation has to ask changes. It is now what a solution is worth, and how much compute you would spend to find out, provided the answer can be checked.

AI arrives first where a machine can check the answer. Proofs. Code with tests. Designs with a simulator. Ask your R&D leadership which of your hard problems have a checker, and which ones you shelved as too expensive to solve. Where those two lists overlap, the capital question has already changed.

Freeze the Models Tomorrow. You'd Still Have Five Years of Work. — 17 September. The slowdown debate assumes companies are running at the frontier. Almost none are, which is why a pause would change very little for them and why the capability in this month's last section matters less than whether you can check it.

A Declaration Is Not a Warranty — 25 September. The EU Cyber Resilience Act gives regulators a 24-hour clock and gives buyers nothing enforceable of their own. ENISA's Single Reporting Platform went live on 11 September with manual web forms and no API. The argument runs parallel to this month's lead: a declaration is handed to you, a warranty is negotiated, and a setting is only protection once someone has checked it.

Next: Data You Cannot Clean, on 9 October.

This month's lead asks whether anyone at your company decided what goes into its AI tools. The Game puts you in the chair where that decision gets made. Five director decisions, scored against NIST AI RMF, ISO/IEC 42001 and the EU AI Act, and in most of them the fast answer is not the governing one. Roughly 15 minutes, no login.

Play the Governance Game

Forward this to a director who should be reading it.

— Fredrik