OpenAI Faked Its Search Limits and Buried Billions of ChatGPT Logs, the Times Says

01OpenAI faked its inability to search training data and hid billions of ChatGPT logs, the Times alleges

The New York Times says it went looking for proof that ChatGPT reproduced its journalism, and OpenAI told the court the search could not be done. The publishers did not accept that answer. In a new motion for sanctions, they allege OpenAI hid tools and datasets that could identify copyrighted news inside model outputs, then claimed a technical inability that never existed.

The accusation flips the case onto new ground. For more than a year, the fight centered on a question of substance: did OpenAI copy the Times and other outlets to train its models. The publishers now allege OpenAI faked an inability to search its own training data, according to filings reported by Ars Technica. That moves the dispute from whether infringement happened to whether OpenAI destroyed the means of proving it.

The Times alleges the deletions were not incidental. OpenAI hid billions of ChatGPT logs relevant to the case, the publishers say, and scrubbed data that would have let them match generated text against their articles. Evidence preservation is a baseline obligation once litigation begins. If a court accepts the account, the missing logs stop being a discovery dispute and become a spoliation problem.

News publishers say OpenAI concealed the internal tools built to surface that same copyrighted material. The claim is specific: not that OpenAI lacked the capability, but that it possessed the capability and kept it out of reach. OpenAI has not confirmed the allegations, and the company has previously argued its training practices are lawful.

The stakes sit in what sanctions can do to a defense. When a party is found to have withheld or destroyed evidence, judges can instruct juries to assume the missing material would have hurt that party. OpenAI may be sanctioned for the alleged conduct, the reporting indicates, a penalty that can decide a trial before the underlying copyright question is argued. Ars Technica framed the episode as a possible fatal misstep.

The motion now sits with the court, which will decide whether OpenAI's account of its search limits holds up. A ruling for the publishers would reshape leverage across the wave of copyright suits AI firms are defending. The Times is asking the judge to treat the gaps in the record as deliberate.

02The AI slop crossed from your feed into your neighborhood and your search results in the same season

The feeds went first. An AI detection company measured what users actually see while browsing, not what platforms host, and found LinkedIn and X saturated with machine-written posts, 404 Media reported. The distinction matters: content-at-rest estimates undercount, because engagement algorithms surface the automated stuff. What lands in front of a scrolling human skews more synthetic than the raw pile suggests.

Then it left the screen. 404 Media documented a "ChatGPT flyer pandemic," physical printouts stapled to poles and pinned to community boards, carrying the tell-tale gloss of generated copy and images. Local organizers started pushing back in the analog way. One flyer drew a handwritten reply: "Hey if this is your flyer, I'm not going, I'm not donating, I'm not sharing. Don't ask me." The rejection was specific and personal, aimed at a lost fundraiser or a block party rather than a policy debate.

Two channels, one direction. AI generation stopped being a thing you sought out and became the default texture of the information around you, online and on the telephone pole. Detection now happens by browsing sample and by neighbor's eye, because no institution was counting.

Google's response arrived as an admission rather than a fix. The company added a "created or edited with AI" label to ads on Search, Discover, and YouTube, visible under a "how this ad was made" tab inside its "My Ad Center," Google announced Thursday, as TechCrunch first reported. Users have to open the panel to see it. The label is opt-in attention, buried a click deep, applied to the one surface Google directly monetizes.

That gap defines the moment. The saturation is measured in browsing data and community anger; the response is a disclosure tag on paid placements, controlled by the platform selling them. Labeling assumes the problem is that people can't tell. The flyer reply suggests people can tell, and have already decided what to do about it.

03GitHub's new AI agent will leak a private repo if a stranger posts an issue

OpenAI is selling ChatGPT Work as an agent that "can take action across your apps and files, stay with a project for hours if needed, and turn a goal into finished work." The pitch is autonomy: hand it access, walk away, come back to output. That access is exactly what security researchers at Noma Labs turned into an exfiltration channel on a competing product this week.

Noma Labs published an attack it calls GitLost against GitHub Agentic Workflows, the automation feature GitHub launched to pair GitHub Actions with an AI agent backed by Claude or Copilot. The workflows are written in plain Markdown. The agent reads issues, calls tools, and responds on its own, without a human in the loop for each step.

According to Noma Labs, an unauthenticated attacker needs only to post a crafted GitHub Issue in a public repository belonging to the target organization. The agent reads the issue. Hidden instructions inside it override the operator's intent, and the agent silently pulls data from the organization's private repositories and sends it back out. Noma calls it a textbook indirect prompt injection: malicious instructions buried in content the agent was designed to trust.

The mechanism is the point. A workflow with permission to read private code is a workflow that can be told to leak private code, and the attacker supplies the instruction from outside the organization entirely. No credentials, no commit access, no phishing. The same delegation that lets the agent work unattended removes the human who would have caught the injected command.

That is the collision developers now buy into. Vendors are pushing agents deeper into codebases and file systems, expanding what a single automation can touch. Every expansion of that reach raises the payoff of one poisoned input. Noma Labs reported GitLost to GitHub; the write-up describes the flaw as critical.