Two of the world’s best mathematicians fed a $1M proof to an AI agent. The vendor can’t rule out it trained on it.

On September 8, OpenAI announced that an internal multi-agent system had solved the Navier–Stokes existence and smoothness problem, a Clay Millennium Prize problem, open since 1822, worth $1 million.

Twelve hours earlier, Tristan Buckmaster (NYU Courant) and Levent Alpöge had published a statement of their own. For a year they had been working, in private, on the closely related Euler equations. In mid-August they got their result. And they had done much of that work using Codex, OpenAI’s coding agent.

Their claim: the unpublished work leaked. Their words: OpenAI “used customer’s data to try to scoop their customer.”

OpenAI’s response is the sentence every CISO should read twice:

“No specific user data was accessed in order to solve this problem”, but the company “cannot rule out that de-identified data derived from their usage of our products helped improve our models.”

The Clay Institute says the problem is “apparently settled” and that verification will be “deliberately unhurried.” The credit dispute is not resolved. It may never be.

This is not a story about OpenAI

It’s tempting to read this as a lab-versus-lab drama. It isn’t. Alpöge works at Anthropic; both researchers were clear the collaboration was strictly personal. This is a story about a user and a vendor, and it is the cleanest illustration we have seen of the threat model we built Agent Zero around.

Look at what did not happen:

• Nobody was hacked.
• No malware ran.
• No permission was abused. Every permission the agent had, the users granted.
• No data-loss control fired. There was nothing for it to fire on.

Two of the most sophisticated people on the planet voluntarily handed a year of intellectual property to an autonomous agent, because the agent was useful. The vendor then could not prove a negative about where that data went.

The whole problem, in one sentence: an authorized agent, an unintended outcome, and zero attribution.

Now replace “mathematician” with “partner”

• A tax partner on a personal iPhone asks Siri to summarize a client’s return and draft the follow-up email. Siri hands it to ChatGPT through App Intents.
• An audit senior in the field photographs a workpaper and asks Claude to check a calculation.
• A service rep asks Gemini to pull together a customer’s account history (plan, billing, call records) before a retention call.
• A product manager pastes the balance sheet into DeepSeek to build a slide.

None of these people is doing anything they think is wrong. They are being productive. And in every case:

• MDM has no reach. It has no policy key. Apple has not shipped a config profile that governs the agent choice or App Intent exposure, and on BYOD, MDM does not reach the device at all.
• MAM has no reach. It sandboxes the corporate app. It does not stop the user from saving an attachment, or an agent from reading the screen once the user grants it.
• EDR and mobile threat defense see approved activity by a signed application. Nothing to flag.
• DLP and CASB can’t see it. They inspect network traffic. Apple Intelligence runs on the Neural Engine. Much of what happens never becomes network traffic, and on a personal phone, routing everything through cloud inspection is not a privacy option.

The Navier–Stokes case is the same failure with better-known victims. As one commentator, Melissa Lee, put it: researchers need to know what happens to unpublished work they enter into AI systems. Your firm’s version of “unpublished work” is client data, deal terms, source code, and CUI.

The vendor’s promise is not a control

The most important line in OpenAI’s statement is not the denial. It’s the hedge. “Cannot rule out” is an honest answer, and it is the honest answer every AI vendor will give, because model training pipelines are not built to prove negatives about individual users.

Which means the only place a CISO can actually enforce policy is before the data leaves the device. Not in the cloud, after the fact, with a vendor’s word as the audit trail.

That is why Agent Zero runs where the agent runs: natively on iOS and Android, at the point where an agent reads, writes, or sends. It sees the action, evaluates it against your policy on the device in under ten milliseconds, and blocks, allows, or audits it, with a record that attributes the action to a user, an agent, an app, a data class, and an intent. Nothing personal leaves the phone. It works on unmanaged BYOD devices, because that is where your data already is.

Legacy security asks: is this allowed? Agent Zero asks: is the agent acting as the user intended, under the CISO’s policy?

Three things to do this week

1. Ask your AI vendors the Navier–Stokes question. “Can you rule out that data from our usage improved your models?” Write down the answer. Most will sound like OpenAI’s.
2. Inventory the agents on your fleet. Not the apps, the agents. Which employees have granted screen access to Siri AI, Gemini, Copilot, Claude, ChatGPT? On corporate devices you can find out. On BYOD you probably can’t. That gap is the finding.
3. Move one control on-device. Pick your most sensitive data class (client returns, CUI, PHI, deal terms) and put a policy in front of the agent, on the phone, before the network. Start with 25 devices. Measure what your existing stack missed.

Terence Tao worried aloud that AI labs might “race past human researchers.” For most organizations the race is quieter: it’s your own people, on their own phones, feeding your most valuable data into tools they trust, and a vendor who, when asked, cannot rule it out.

Yes, AI. Zero drama.

Agent Zero is a native, on-device security layer that sees, blocks and audits every AI-agent action on iOS and Android before it leaves the chip. Our design-partner program is open: a live deployment on your fleet, your policies, your KPIs.

Book a demo, 30 minutes on a real device

Source: Navier–Stokes priority controversy, Wikipedia