The date is July 3. Nobody outside OpenAI has explained what it means.
That single timestamp carries the entire weight of the controversy. Over roughly two months, a mathematician named Buckmaster and his collaborator Alpöge submitted unpublished drafts — LaTeX, proof sketches, partial arguments — to Codex. In mid-August, their own research reached a critical breakthrough on the Navier-Stokes problem. Around the same window, OpenAI reportedly concentrated compute and produced a proof of its own in a matter of days.
OpenAI's internal investigation concluded that Buckmaster's prompts "could not possibly have influenced the internal model in any way, including through training." The company did not clarify what July 3 denotes. The community supplied its own readings: training-data cutoff, checkpoint freeze, retention-policy change, or a communications artifact.
One of those is a technical fact. The other three are guesses. The distance between them is where this dispute actually lives, and no public document currently closes it.
Context: what was submitted, and to what
Codex is not a general chat product. It is a code-and-technical-task model, tuned for LaTeX, algorithm descriptions, and executable fragments. That matters, because the material users hand it is precisely the material with the highest training value. There is economic motive to absorb it. There is also a contractual question, unaddressed in every account I have read, of whether the service terms applicable at the time permitted it.
The timeline runs like this. Prompts submitted across approximately two months. A cutoff on July 3. A human breakthrough in mid-August. A machine-generated proof in the days that followed. A denial issued after the fact. That sequence is the whole of the public evidentiary record. Everything else is inference.
Here is the structural flaw in the reporting, and it is the same flaw I have spent nine years correcting in token audits: the discussion collapses four distinct mechanisms into one phrase — "the model saw the data." Those mechanisms are not equivalent, and they do not carry the same risk.
Inference-time input. A prompt submitted to a stateless model does not alter model weights in real time. If session state is discarded, nothing propagates. This is the strongest element of OpenAI's defense, and almost no participant in the debate mentions it.
Training ingestion. If prompts entered a subsequent training corpus, they influence weights. Here the date matters absolutely. Prompts before the cutoff may be contaminated. Prompts after it cannot be, assuming the cutoff is what it appears to be.
Feedback pools. RLHF pipelines can retain prompt content without full training ingestion. Content can shape preference models even where it never enters a base corpus.
Human review. Annotation queues are the most opaque of the four. No published policy I have located governs what a human reviewer may subsequently do with what they have read.
There is a fifth path, rarely named: retrieval augmentation. A user document can be surfaced back to other users without any weight change at all.
Core: what the evidence establishes, and what it does not
The July 3 cutoff is the only concrete artifact in the record, and it has never been explained by the party that set it.
That is a provenance failure, and provenance is a discipline I know from harder ground. In 2017 I spent six weeks reverse-engineering deployment scripts for a token sale that had raised nine figures. The whitepaper was immaculate. The vesting logic was not. Three scheduling defects systematically favored early backers over community holders, and none of them were visible from the marketing material. The claim could not be verified by reading what the issuer chose to publish. It could only be verified by reading what the issuer had to run.
In 2020 I monitored pool balances for a yield protocol on a fifteen-minute interval and documented that its headline APY came from token emissions rather than trading fees. The critical number was not the yield. It was slippage: a 5% withdrawal would have moved the pool materially. That figure did not appear anywhere in the project's own materials. I derived it from chain state.
In 2022, before the collapse everyone now claims to have predicted, the Terra reserve audits from 2019 through 2021 contained persistent discrepancies in reported burn rates. The architecture was not merely fragile. It was mathematically unstable under stress, and the arithmetic said so well in advance.
The pattern in all three cases is identical, and it is the pattern here. A claim is asserted by a party that is also the only party able to verify it. The resolution was never a statement. It was the ledger.
There is no ledger in this case.
Model weights are not a public chain. There is no block explorer for a training corpus. There is no immutable record of which prompt entered which pipeline, on which date, and under which retention rule. OpenAI's conclusion is the product of an investigation conducted by OpenAI, and it is offered without third-party verification, without contamination-testing disclosure, and without a technical specification of the cutoff's meaning.
Consider what the timeline argument actually accomplishes. The mid-August breakthrough postdates July 3. That materially undercuts one specific allegation: that the human breakthrough was absorbed and re-emitted. It does not address early drafts submitted before the cutoff. It does not address the feedback path. It does not address human review. It does not address retrieval.
A cutoff date establishes sequence. It does not establish isolation. Those are different claims, and only one of them has been made.
What a verifiable audit would require is neither exotic nor expensive. Retention logs for the specific account, with hashes. Training corpus manifests with version commitments. Checkpoint timestamps, cryptographically attested. Contamination detection run in the open — membership inference, canary insertion, loss-based extraction probes. Third-party read access to the audit, not to the weights.
None of that requires disclosing model internals. Isolation can be proven without disclosure. It simply has not been.
Four questions would settle most of it, and none has been answered on the record. Did Buckmaster's submissions fall before or after July 3? Did any enter a training set, a fine-tuning set, a feedback pool, or a review queue? Was the applicable retention policy at the time disclosed to the user? And was contamination testing conducted by anyone outside the company?
I will say the harder thing. The ledger does not lie, but it forgets. And a system that was never built to record whether a given document entered a given pipeline will forget this question permanently, regardless of what the eventual finding turns out to be.
Contrarian: what the skeptics are getting wrong
The loudest critics are committing the category error they accuse OpenAI of. They merge inference, training, feedback, review, and retrieval into a single word — "exposure" — and then treat the aggregate as damning. That is not forensics. It is suspicion with technical vocabulary attached.
Stripped of that conflation, OpenAI's position has a genuinely defensible core. Inference-time prompts do not rewrite weights. The August timing does undercut the strongest version of the accusation. A careful reader should update toward unproven, not toward proven. Those are different verdicts, and the difference is the discipline. I hold no position on whether the proof is valid. Nobody outside the company can, because it has not been verified, formalized, or published.
The second thing the skeptics miss: this industry has no standing to demand third-party data audits.
I have watched protocols publish double-digit yield without disclosing emission schedules. I have watched teams ship upgradeable proxies with no timelock and call the result decentralized. Where was the third-party audit for Terra? It arrived after the collapse, in the form of the collapse. The crypto sector built an entire asset class on the premise that self-attestation is insufficient, and then applied that premise to everyone except itself.
So the honest position is narrower than either camp prefers. OpenAI has not been shown to have contaminated anything. OpenAI has also not demonstrated isolation by any standard this industry would accept from a smart contract. Both statements are true at the same time.
Takeaway
Buckmaster and Alpöge will publish or they will not. OpenAI will clarify July 3 or it will not. The publishable question is not who is lying. It is whether the field continues to accept a cutoff date as evidence of isolation, when a cutoff date is evidence only of sequence.
If it does, the next dispute will be structurally identical, and the one after that, and the sector that spent a decade arguing that code is law will have conceded that, for the systems that matter most, there is no code to read.
The ledger does not lie. But it forgets — and here, there is no ledger to forget with.