📅 October 31, 2026 • The Decoder
OpenAI is changing how it handles data from Daybreak Blue, the company's Capture-The-Flag cybersecurity training environment. Starting November 29, 2026, according to the email OpenAI sent to Trusted Access members, session data from these practice exercises on personal accounts will be used for model training, while Business and Enterprise accounts and Zero Data Retention setups stay unaffected. Until now this category of data was excluded from training entirely, even when users had switched off the "improve the model for everyone" option in their settings. In other words, the general toggle did not govern this particular data, and it stayed out of the training pipeline regardless of user preferences. From November 29 the general toggle no longer protects these sessions, which is why a dedicated opt-out was promised. Capture-The-Flag exercises are a common format in security education, where participants solve hands-on challenges in a sandboxed setting rather than on live systems.
How the change works
From the November 29 date, transcripts of Daybreak Blue sessions will flow into the standard training pipeline alongside other permitted data. The official help page documents the rule without a date, and the notification did not tie the change to a specific model release. Sessions of this kind typically contain detailed technical work, such as tool usage, exploit attempts in the sandbox and step-by-step problem solving, which makes them a substantial source of training material. What the first email did not explain was how users could keep this content out of training, and that gap quickly became the main point of contention for recipients.
Criticism and the second email
The first notification email drew visible user criticism, with many readers pointing out that the change appeared to override privacy preferences they had already configured. In response, OpenAI sent a second email promising a dedicated opt-out setting specifically for CTF session data. According to the same reporting, interactions flagged during safety reviews may still be used for safety purposes, which means they are not excluded from training and an opt-out from training would not prevent that use. The sequence of two emails within a short window is unusual for a policy notification, and it reflects how quickly the reaction gathered.
Impact
For anyone using Daybreak Blue, the practical takeaway is a new decision to make. Users who want their practice sessions excluded from training will need to watch for the promised opt-out setting, which was not exposed in Daybreak sessions as of October 31, and activate it before the November 29 start date if it appears in time. The episode also illustrates how specialized product surfaces can carry data rules that differ from the main chat product, and how companies adjust their communication when users push back on a policy change. The key detail to watch is whether the opt-out actually arrives before training on this data begins. Whether the promised setting will cover only future sessions or also previously collected data is not specified in the report.
Sources: the-decoder.com and help.openai.com
Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky
Top comments (0)