What happens to a theorem between the moment you conjecture it and the moment it appears in print? For most of mathematical history, the answer was: it sits in a notebook, gets whispered to two colleagues, and maybe survives a seminar. Now, increasingly, it sits in a context window on a server you do not own, operated by a company whose leadership you may or may not trust, under privacy rules that regulators are still writing.
That is the uncomfortable shape of the question mathematicians are starting to ask out loud. Not “is the model good at math” — the answer to that keeps improving — but “what is the actual data path when I paste my working notes into an agent?”
Why math is a special case
Most discussion of AI and research security borrows its intuitions from software or clinical data. Neither maps well onto pure mathematics. A codebase has value that decays; a clinical dataset has legal protections and institutional review. An unpublished proof has neither. Its entire value is priority, and priority is binary. You either got there first or you are a footnote.
This makes math unusually exposed. There is no HIPAA for a lemma. There is no IRB reviewing whether your partial result should leave the building. The norms that protect unpublished mathematics are social — you do not scoop a colleague — and social norms do not extend to inference infrastructure.
The counterargument is reasonable and worth stating plainly: OpenAI has published its own account of how researchers inside the company work, describing coding agents running throughout the day, often in concurrent sessions, with total usage climbing fast. That is a real signal about capability and about workflow. If internal researchers are getting meaningful acceleration from agentic tooling, external researchers are right to want the same thing. Nature has covered whether the deep research tool is genuinely useful for scientists, and scientists have shown they will move quickly toward whatever works — the rapid uptake of DeepSeek among researchers made that obvious.
The architecture question nobody wants to answer
Here is where I want to be precise, because the debate keeps getting fought at the wrong altitude. The question is not whether a company is trustworthy in some general moral sense. The question is architectural, and it decomposes into things you can actually audit:
- Does your input persist beyond the request, and for how long?
- Does it enter any training pipeline, by default or by opt-in?
- Who inside the provider can read it, and under what review process?
- What happens to it during an abuse investigation, a subpoena, or a regulatory audit?
- If the answers change, are you notified, and does the change apply retroactively to data already ingested?
Most researchers I talk to cannot answer more than two of those for the tools they use daily. That is not a character flaw. It is a design outcome. Agentic systems are built to feel like collaborators, and collaborators do not hand you a data flow diagram before a conversation.
The regulatory record suggests these questions are not paranoid. The joint investigation into OpenAI under Canada’s PIPEDA framework produced findings that explicitly acknowledged the technology raises questions beyond the privacy risks the report itself addressed. When regulators say “and there is more here we did not cover,” that is a signal about scope, not reassurance.
The trust gap is structural, not personal
Concerns about leadership and ethical risk at frontier labs have not gone away, and at least one AI researcher has publicly warned that companies are ignoring catastrophic risks. You can hold that concern and still use the tools. I do. But the reason the concern matters for math specifically is that trust in an inference provider is not a single decision — it is a standing bet, renewed every time you paste something in, on a policy surface that can change without your involvement.
There is an economic dimension too. Academic labs are already contending with what has been called a $1.5 million “academia tax” on doing frontier AI research. If the affordable path to acceleration runs through commercial APIs, then the option to keep unpublished work on infrastructure you control is priced as a luxury. Confidentiality becomes something well-funded institutions can afford and everyone else negotiates away.
What I would actually do
Not abstention. Abstention loses to colleagues who use the tools, and the productivity delta is real enough that pretending otherwise is bad strategy.
Instead: tier your work. Exploratory computation, literature search, and code for numerical experiments go to hosted agents freely. The statement of an unpublished main theorem, the key construction, the step you have not yet convinced yourself of — those stay local, or get sent in a form stripped of what makes them yours. Treat the context window as a publication venue with an unclear embargo policy, because functionally that is what it is.
Greg Brockman described the current state of agents as something close to micromanagement — you supply the tasks, you supply the context, because the system does not have it. That framing cuts both ways. The context you supply is the asset. Deciding what not to supply is, for now, the only access control you fully own.
🕒 Published: