The training rules for OpenAI Daybreak Blue sessions are about to change. On October 31, The Decoder reported, citing emails sent to members of the Trusted Access programme, that from November 29 data from these cybersecurity sessions may be used to train models, even if an account has turned off the "Improve the model for everyone" master switch. OpenAI then promised in a second email to add a separate opt-out switch, but its launch date and default setting have not been announced.
Why turning off the master switch does not stop it
Daybreak Blue is a tier of OpenAI's Trusted Access programme for cybersecurity, for vetted security researchers doing defensive work such as vulnerability triage, secure code review and incident response. According to The Decoder, these sessions were previously outside the scope of training; the new rule carves them out as a separate exception: the content of personal-account Daybreak Blue sessions may be used to improve models, and the master switch no longer covers this category. OpenAI's updated ChatGPT data-controls page makes the same distinction: the master switch continues to govern other activity outside Trusted Access sessions, while inputs and outputs from Business, Enterprise, Edu and API Platform services are not used for training by default. OpenAI says the training use is intended to strengthen safeguards against cyber misuse. The problem is that these sessions often contain undisclosed vulnerability details, proof-of-concept code, logs and client system structures, and once they enter the training pipeline researchers can no longer control where they go.
What researchers are still waiting for is the detail of the opt-out
In the information made public so far, the opt-out is only a promise, with no implementation plan: when it will launch, whether it will be on or off by default, and whether it will cover sessions before November 29 have all not been stated. Safety review is a further exception: interactions flagged for safety review may still be used for safety purposes, so even opting out of training does not necessarily mean the data will not be used at all. Until the detail is published, Daybreak Blue members cannot assume the master switch is still protecting them; material involving undisclosed vulnerabilities or sensitive client structures should not be pasted into a session in a hurry — wait for the actual opt-out rules. What is available now comes from reporting on the programme members' emails and the updated data-controls page, and the detail of the opt-out will depend on the rules OpenAI publishes next.
At the same time, OpenAI is also changing its subscription rules: ChatGPT and Codex will share one usage allowance from December, so heavy coding use leaves less chat allowance. Taken together, subscribers face the same pattern in late November and December: the default rules have changed, and the new boundaries have to be checked by the user.
