Thom, a geometric group theorist at Leipzig, says he shared an unpublished proof for an invitation-only OpenAI evaluation program and GPT-5 later reproduced the argument in near-identical form. He carefully avoids accusing OpenAI of theft, but argues he can no longer construct a plausible chain of custody in which his work didn't end up in a training corpus.
Capraro amplified Thom's thread on X and lent his own credibility to the concern. His involvement signals that this isn't a one-off complaint but part of a broader pattern researchers are noticing when their proprietary problems reappear in model outputs.
The submitter framed the story explicitly as 'more questions,' linking Thom's incident to the unresolved FrontierMath controversy where Epoch AI's OpenAI funding wasn't disclosed to contributing mathematicians. The 760-point score and 692 comments suggest the HN community sees this as a repeating pattern of private problem → private access → public benchmark win, not an isolated incident.
The editorial argues that math is uniquely diagnostic because proofs are legible in a way code and prose are not — a proof is either the same proof or it isn't, with no 'independent convergence' hand-wave available. That makes mathematician complaints stronger evidence than analogous claims from other fields, and a warning signal for anyone shipping work near a frontier lab's API.
On Mathstodon this week, Leipzig mathematician Andreas Thom posted a thread that is now sitting at 760 points on Hacker News and rippling across academic Twitter. Thom says he shared an unpublished proof — one he'd developed for a small, invitation-only evaluation program tied to OpenAI's frontier-math work — and that GPT-5 subsequently reproduced the argument in a form close enough to be uncomfortable. Valerio Capraro amplified the thread on X, and other researchers chimed in with their own near-miss stories about proprietary problems reappearing in model outputs.
Thom is not a crank. He's a working geometric group theorist with a long publication record, and he's careful in the thread to distinguish what he can prove (the proof came back) from what he can only infer (how it got there). His claim isn't that OpenAI stole his work — it's that he can no longer construct a plausible chain of custody in which it didn't end up in a training corpus. That is a subtler and, for the field, more damaging accusation.
This lands on top of an unresolved 2024 controversy: FrontierMath, the benchmark Epoch AI built and OpenAI quietly funded, whose problems OpenAI had access to before the o3 announcement that used them as the headline capability result. Epoch later acknowledged the funding arrangement had not been disclosed to the contributing mathematicians. The pattern — private problem, private access, public benchmark win — is exactly the pattern Thom is now describing at a smaller scale.
The naive read is "academic drama, not our problem." That read is wrong, and it's wrong in a way that should worry anyone shipping code near a frontier lab's API.
The math community is a canary because its outputs are unusually legible. A proof is either the same proof or it isn't; there's no "we independently arrived at similar architecture" hand-wave available. When a mathematician says "that's my unpublished argument, verbatim," the claim is checkable in a way that "that looks like our internal codebase" almost never is. Which means: if leakage is happening in math, it is almost certainly happening in the domains where it's harder to detect.
The mechanism doesn't have to be malicious. Modern eval pipelines are messy. Problems submitted through a "private" portal get logged, mirrored to internal QA tools, pulled into red-team datasets, forwarded to contractors for human grading, and — critically — used to build the very reasoning traces that get distilled into the next model. There is no single "add to training set" button anyone pressed. There is a diffuse system in which any text that enters the org is, by default, at risk of becoming gradient. OpenAI's public position has been that eval data is walled off. The FrontierMath episode showed the wall is at best procedural, and Thom's thread suggests procedural walls are not holding.
The community reaction has been sharper than usual. Kevin Buzzard and other Lean-adjacent researchers have been pointing out for months that the incentive structure — labs paying for hard problems, then using those problems as capability proof — is structurally corrupt regardless of intent. The FrontierMath funding conflict wasn't a one-off; it was the visible edge of a business model in which "we can solve problems experts can't" is worth billions, and the experts are the ones providing the problems. On Hacker News, the top comments are already generalizing: replace "unpublished proof" with "proprietary SQL," "internal RFC," "unreleased API schema," and the same trust question applies.
The uncomfortable comparison is to Copilot's early days, when GitHub argued that training on public repos was fair game and users argued that "public" and "license-compatible with commercial reproduction" are not the same thing. That fight is still in court. The new fight is a level up: data that was never public at all, shared under explicit evaluation agreements, showing up in model outputs. If OpenAI can't produce a clean answer for how Thom's proof got there, the industry doesn't have a defensible story for anyone else's confidential inputs either.
Stop treating eval NDAs as load-bearing. If you're piping proprietary code, prompts, prompts-with-embedded-secrets, or unreleased product specs into any frontier model — including through "private" enterprise tiers — the operational assumption should be that the text is recoverable, in some form, by a sufficiently motivated future model. That doesn't mean don't use the APIs. It means threat-model them the way you'd threat-model sending the same data to a well-meaning but under-staffed vendor with a leaky logging pipeline.
Concretely: separate what you send. Structural prompts and public context can go to the hosted API. Anything that would embarrass you or your customers in a training-set audit should either stay on a self-hosted open-weights model (Llama 3.3, Qwen 2.5, DeepSeek-V3 are all now credible for code and reasoning work) or go through a vendor with a contractual and audit-trail guarantee of zero retention — Anthropic's zero-retention tier, Azure OpenAI's no-training commitment, or Bedrock. Get the auditor's report, not just the marketing page.
For teams doing evals of models — internal red-team suites, capability benchmarks, regression tests — assume any problem set you share becomes benchmark contamination the moment a lab sees it. Keep a rotating held-out set that you never send. This is annoying, and it's also the only way your numbers mean anything six months from now.
The near-term outcome most people are betting on is a defensive statement from OpenAI, some clarifying blog post about eval data handling, and the story fading. That may be what happens. But the underlying dynamic — labs need harder and harder problems to demonstrate progress, the only source of those problems is the people whose trust is being burned — doesn't resolve with a blog post. Expect the next FrontierMath-style benchmark to be built with cryptographic commitments, third-party escrow, or simply refusal by the mathematicians involved. And expect enterprise procurement to start asking, in writing, questions that today are handled with a handshake.
<a href="https://mathstodon.xyz/@andreasthom/117240536885387540" rel="nofollow">https://mathstodon.xyz/@andreasthom/117240536885387540</a><p><a href="https:
→ read on Hacker NewsTop 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.