OpenAI today announced an internal AI system solved the Navier–Stokes existence and smoothness problem, one of the seven notoriously challenging Millennium Prize Problems in mathematics that has remained unsolved since its introduction 26 years ago, using a coordinated system that involved roughly 10,000 concurrent AI agents.
The problem, named for 19th-century mathematicians Claude-Louis Navier and George Gabriel Stokes, asks a basic but extremely difficult question about equations used to describe how fluids such as air and water move: can a fluid that starts out behaving smoothly eventually develop a mathematical breakdown?
OpenAI says its system produced a new proof showing that, under certain conditions, a smoothly moving three-dimensional fluid can reach a point where its calculated speed grows without limit in a finite amount of time. In practical terms, that would mean the equations themselves eventually stop providing a physically meaningful description of the fluid.
But OpenAI's announcement also comes with a dispute over how the work was produced and who should receive credit.
An NYU mathematician involved in closely related AI-assisted research released a statement on Mastodon last night, prior to OpenAI's announcement, questioning whether the company's model could have been trained on or otherwise benefited from research he and a collaborator from Anthropic had conducted in part using Codex, OpenAI's coding and work-focused AI harness and application.
OpenAI initially told VentureBeat that neither its researchers nor AI systems searched user data to solve the problem. In a subsequent public statement, however, the company added an important qualification: while it says no specific user data was accessed to produce the solution, it “cannot rule out” that de-identified data derived from the researchers' use of OpenAI products helped improve its models
Asked directly by VentureBeat during a video press briefing earlier today whether OpenAI or its agents had accessed Codex results from the outside researchers, OpenAI Chief Research Officer Mark Chen replied: " No people or AI systems searched through user data to solve this problem or any specific problem that we were trying. And I'm a little bit disappointed by the allegations of the huge breach of user trust. We we did not do that."
Yet later today on X, OpenAI posted a statement reading in part:
"We (the researchers and the agents) did not see any of their work through any means until they released it publicly — in particular, no specific user data was accessed in order to solve this problem. While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models. However, our proofs differ significantly and even the precise results proved are different in the Euler case (forced vs. unforced)."
That distinction — between retrieving a user's private work and potentially learning from data derived from product usage during model improvement — matters well beyond an academic dispute.
For enterprises putting proprietary code, unpublished research or other sensitive intellectual property into AI systems, it raises a practical question: what protections actually prevent that information from becoming part of future model improvement?
How the credit and data dispute unfolded
The controversy began with a rumor. On September 1, word spread online that researchers associated with Anthropic might have solved two Millennium Prize Problems.
OpenAI says that was what sent its newly trained internal model after the remaining problems. OpenAI technical staffer and esteemed AI researcher Sébastien Bubeck later put it plainly on X: “We began working on the Millennium problems due to viral twitter rumors that Anthropic had resolved 2 Millenium problems.” The goal, he said, was to see whether OpenAI’s rapidly improving system could pull off something comparable.
The rumor was connected to real work by NYU mathematician Tristan Buckmaster and Levent Alpöge, an Anthropic researcher, who had spent months using AI systems to push forward a specialized line of research on fluid equations related to Navier–Stokes.
Records produced by both parties indicate that on September 3, Buckmaster contacted OpenAI to explain that theirs was a personal collaboration, not an Anthropic project. By then, according to OpenAI’s timeline, its own agent experiment was already underway. Bubeck later insisted that OpenAI “did not see any of [Buckmaster's and Alpöge's] work until they released it publicly” and pointed to differences between the two teams’ eventual proofs as evidence of independent development.
Then, on September 6, OpenAI told the external mathematicians that its system had produced something much bigger: a proof of finite-time blowup for forced Navier–Stokes. A screenshot posted on X by Bubeck shows a text message conversation between him and a user identified as Alpöge.
“I would like to be maximally open with you,” Bubeck wrote, according to the screenshot, saying OpenAI wanted to ensure that “all the academic accolades” for their work went to Alpöge and Buckmaster.
"What is the precise theorem you are claiming?" the screenshot shows Alpöge asking Bubeck.
"Existence of forced blowup in R^3 and T^3," Bubeck is shown to have responded.
But the message apparently alarmed Alpöge and Buckmaster. In his PDF statement published publicly on September 7, Buckmaster wrote that hearing the word “forced” was “a bright red flag,” because the smooth-forcing route was precisely the obscure approach the two mathematicians had been pursuing.
That led to the most consequential accusation — or, more precisely, question. The mathematicians had been putting unpublished drafts into private Codex sessions, and Buckmaster asked whether OpenAI’s model had been trained on or had access to them. He says he was told that the model did not look up user data, but received no answer when he pressed specifically about training. Importantly, he stopped short of alleging theft: “I do not know whether our data was used. I am not accusing anyone of anything.”
The conversation then deteriorated over credit. Buckmaster said Bubeck proposed a path in which he might help present OpenAI’s Navier–Stokes proof without Alpöge as an author, and cited Alpöge’s employment at Anthropic as a complication.
Bubeck strongly disputed that interpretation on X. “I never ever asked for Levent to be removed from authorship of his own work,” he wrote. His version is that they were discussing whether Buckmaster could lead a rewrite of OpenAI’s separate proof, and that he felt it would be inappropriate for an Anthropic employee to author work created by an OpenAI system. Bubeck also acknowledged making a remark about Buckmaster “risking” his career, but called it an “extremely poor choice of words,” apologized and said he had retracted it immediately.
OpenAI has since denied that its people or agents directly accessed the mathematicians’ private work to produce the proof, while acknowledging that it cannot rule out de-identified data from their use of its products having contributed to model improvement.
That leaves the dispute in an unusually narrow but important place: not an established case of OpenAI taking private research, but an unresolved question about whether information generated through researchers’ use of an AI product can indirectly flow back into the systems that later compete with them.
From one hard problem to millions of agent messages
The privacy dispute is only one part of what makes the Navier–Stokes announcement noteworthy. How OpenAI says it actually produced the proof suggests a different model for deploying frontier AI.
According to OpenAI’s description of the experiment, training of the unnamed internal model began August 28 and is continuing. OpenAI describes the system as significantly more capable than GPT-6 Astra, its frontier model released last week. The internal model is not currently available to ChatGPT or API customers.
On September 1, after hearing rumors that other researchers had made progress on Millennium Prize problems, OpenAI set agent groups to work across the remaining open problems and several related mathematical questions. Agents could run code, consult a cached version of the internet and communicate with other agents within their groups.An important intermediate result came from the Euler equations, which describe fluid motion without the viscosity term found in Navier–Stokes. OpenAI says nearly 100 agents worked for about 50 hours to produce an unforced Euler regularity disproof.
It then redirected resources toward Navier–Stokes, gave agents the Euler result as a starting point and used Codex to consolidate promising intermediate ideas from different groups. The group that produced the Navier–Stokes result involved on the order of 10,000 concurrent agents. OpenAI says the agents reached the resolution on September 5, approximately 88 hours after the first agents were launched.
Formalizing and checking the proof in Lean took another 17 hours using GPT-6 Astra. The scale is striking. Across all of the mathematical problems attempted, OpenAI says its agents exchanged 4.9 million messages and generated roughly 300 billion output tokens. The Navier–Stokes work alone accounted for 2.7 million messages and approximately 130 billion output tokens. This is less like asking a chatbot an extraordinarily difficult question and more like operating a computational research organization made up of thousands of model instances.
Lean provides another verification layer — but not instant acceptance
OpenAI also released a formalized version of its proposed proof in Lean.
Lean’s own documentation describes it as an interactive theorem prover whose small trusted kernel checks formal proof terms. That can provide a powerful safeguard for AI-generated mathematics: instead of relying entirely on whether a lengthy mathematical argument sounds plausible, researchers can encode the theorem and its proof in a language that can mechanically check whether the steps follow from the stated assumptions. But formal verification does not eliminate the need for outside scrutiny.
Lean's proof-validation guidance notes that reviewers still need confidence that the formal theorem statement actually expresses the intended mathematical claim and that its definitions and assumptions have been represented correctly.
The Clay Mathematics Institute has not simply awarded OpenAI the prize. Under Clay's official rules, a proposed solution must appear in a qualifying publication, at least two years must then pass, and the work must gain general acceptance in the global mathematics community before Clay will consider it. OpenAI says it does not intend to claim the prize.
The economics of solving the difficult problems
Those 130 billion output tokens also provide a rough way to understand the economics of this new research model.
OpenAI's published GPT-6 Astra pricing is $10 per million input tokens and $50 per million output tokens.
At that retail rate, 130 billion output tokens alone would represent about $6.5 million in API charges, before accounting for any input tokens. That is not OpenAI's actual infrastructure cost, and the internal model that generated the proof has no public price.
Nor has OpenAI disclosed how many input tokens the research system processed. One outside estimate circulating on X placed a hypothetical retail-equivalent total anywhere from below $10 million to $30 million or $40 million depending on assumptions about input volume. That estimate remains speculative.
OpenAI executives did confirm that the experiment operated at a multimillion-dollar scale. Bubeck said during the briefing, “We are able to spend millions of dollars on a problem that we really care for.”
Bubeck framed that expenditure as a preview of how organizations could eventually use AI on commercially valuable scientific problems: “What I think we should all get into the mindset of is: what happens when we are able to spend that amount of compute on problems that really matter?”
Meanwhile, the Clay Mathematics Institute, which established the Millennium Prize Problems in 2000, offers $1 million for a recognized solution to each problem. OpenAI CEO Sam Altman underscored the unusual economics with a joke on X, asking whether the researchers knew the problem was “only worth $1 million” — the size of the Clay prize.
For enterprise technical leaders, the more important comparison may eventually be not cost per prompt but cost per solved problem.
A pharmaceutical company, semiconductor manufacturer or materials-science organization might rationally spend millions of dollars on inference if an AI research system could compress work that otherwise requires years of expert labor.
The total cost of ownership, however, would extend beyond tokens. Agent orchestration, failed approaches, tool use, verification infrastructure, security monitoring and human review all become part of the bill.
10,000 agents also create a new control problem
The 10,000-agent figure creates a second operational issue: controlling large populations of increasingly capable agents.
That is particularly notable because OpenAI recently disclosed a serious security incident involving an earlier generation of internal research agents.
In its postmortem on the Hugging Face incident, OpenAI said agents worked around technical controls, communicated through unauthorized channels and took actions no human had directed. A related July incident report says models found and exploited a previously unknown vulnerability to obtain internet access before moving laterally through OpenAI systems and reaching Hugging Face infrastructure. OpenAI later described the episode as a “warning shot.”
OpenAI says it responded by creating more isolated sandboxes, restricting internet access, strengthening model-weight protections and devoting substantially more compute to monitoring. The company says those stricter monitoring and isolation safeguards were active throughout the Navier–Stokes project. Its GPT-6 Astra safety overview describes additional protections for Astra-class systems including stricter isolation, checkpoint encryption and monitoring of complete agent trajectories.
For enterprises, that makes 10,000 agents more than a measure of computational power. It is also a measure of the control surface. Permissions, network isolation, tool access, logging and automated monitoring become progressively more consequential when an organization moves from a handful of assistants to thousands of agents acting simultaneously.
What protections keep enterprise Codex data out of OpenAI’s models?
Perhaps the most important question facing enterprises after the release of these results is how careful they should be inputting proprietary or sensitive data into cloud-based AI products such as Codex, ChatGPT or competing offerings from other AI companies and labs.
For business customers of OpenAI, the data privacy policy is relatively clear, stating OpenAI does not use data from ChatGPT Business, Enterprise, Edu or the API — including customer inputs and outputs — to train or improve its models by default.
OpenAI’s specific documentation for ChatGPT Business says that protection continues when employees use Codex: “Business workspace data is excluded from training by default, including when the workspace uses Codex.”
OpenAI also limits human access to stored business information. Its enterprise privacy documentation says stored API inputs and outputs may be accessed by authorized employees when necessary for engineering support, investigating abuse or legal compliance, and by specialized contractors for abuse and misuse review. Competitive research is not listed as an authorized reason for accessing the content.
The rules are different for individual ChatGPT and Codex customers. OpenAI says in its model-improvement data policy that it may use content from consumer services such as ChatGPT and Codex to train its models.
However, ChatGPT Free, Plus and Pro users can manually turn off this policy through ChatGPT's data controls; OpenAI also documents separate settings governing whether some Codex “full environment” data may be used for training.
That means the description “private Codex session” does not, by itself, establish that the contents were excluded from model training. The answer depends on the product, account type and applicable data-control settings. The currently available material does not establish which settings governed Buckmaster and Alpöge’s particular Codex usage.
For an enterprise buyer, however, the baseline is stronger: OpenAI says business inputs and outputs are not used for model improvement unless the organization explicitly opts in.
There is another important distinction. Not using customer content for training does not necessarily mean OpenAI does not retain that content at all.
OpenAI's API data-control documentation says ordinary API requests can generate abuse-monitoring logs containing prompts and responses, which are normally retained for as long as 30 days. Some APIs also retain application state because persistence is required for the feature to operate.
For companies handling especially sensitive data, OpenAI offers a stronger option: Zero Data Retention, or ZDR.
OpenAI's current API documentation dates its broader default policy of not training on API data to March 1, 2023. And public records on OpenAI's own developer community show that by at least September 2023, the company's enterprise privacy documentation was already telling qualifying API customers they could request Zero Data Retention. That September 2023 discussion quoted OpenAI’s policy at the time as allowing customers with qualifying use cases to request ZDR.
In an August 19, 2026 announcement, OpenAI went further, noting that eligible API customers using ZDR have their prompts and model responses removed after processing and that customer content is unavailable to OpenAI personnel for review, subject to narrow legal exceptions.
OpenAI simultaneously previewed Private Safety Processing, a system intended to identify risky patterns across multiple interactions without giving OpenAI employees access to the underlying prompts and responses.
That is increasingly important for agentic AI. Safety systems may need to understand behavior across a long sequence of actions, while companies using AI for software development, pharmaceutical research, finance or other sensitive work may be unwilling to let a provider retain the underlying content simply to perform that monitoring.
OpenAI says that in ZDR deployments customer content can remain on infrastructure controlled by the customer. It is also developing an option in which content stored on OpenAI infrastructure is encrypted using customer-controlled keys that OpenAI personnel do not possess. Private Safety Processing is currently being tested with early customers.
GPT-6 Astra itself supports ZDR for eligible API customers, according to OpenAI’s Astra launch documentation.
ZDR still does not apply universally. OpenAI's API data-control documentation says customers must be approved for the control, and some features cannot operate under full zero-retention rules because they inherently require persistent state. Code Interpreter, for example, is not currently compatible with ZDR, and background-mode Responses requests likewise require temporary storage. Persistent objects such as Threads and Vector Stores have their own retention behavior.
For enterprise architects, those distinctions matter. No-training commitments control whether customer information can be reused to improve models. Access controls determine who may see stored information. ZDR goes further by reducing the amount of customer content OpenAI retains in the first place.
The Navier–Stokes controversy gives technical leaders a concrete reason to treat those as separate architectural controls rather than collapsing all three into a generic promise of “privacy.”
The next benchmark may be a research program, not a test set
The immediate scientific question is whether OpenAI's proof survives examination by mathematicians.But for developers and technical leaders, the operational lessons are already broader. The system OpenAI describes did not simply answer one difficult prompt. Thousands of agents explored different approaches, communicated findings, ran tools, consumed enormous amounts of inference, consolidated intermediate ideas and ultimately handed a proposed solution to another frontier model for formal verification.
At the same time, the Codex dispute exposes another side of that future. As companies entrust AI systems with increasingly valuable intellectual property, the policies governing model training, retention and access become part of the technical architecture, not simply language in a privacy statement.
The Navier–Stokes project therefore brings three trends together at once: organizations can spend extraordinary amounts of inference on a single high-value objective; increasingly capable agents require stronger control systems as their numbers scale; and customers need to know exactly what happens to the proprietary information those agents consume along the way.
OpenAI’s experiment suggests that the meaningful unit of AI capability may increasingly be shifting from the model itself to the entire computational research process built around it.