{"id":9194,"date":"2026-08-20T00:12:50","date_gmt":"2026-08-20T00:12:50","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9194"},"modified":"2026-08-20T00:12:50","modified_gmt":"2026-08-20T00:12:50","slug":"openai-temporarily-slows-scaling-efforts-also-promises-zero-data-retention-for-select-frontier-model-customers","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9194","title":{"rendered":"OpenAI \u2018temporarily slows\u2019 scaling efforts, also promises zero data retention for select frontier model customers"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

OpenAI this week announced multiple moves designed to counter negative perceptions of its security and privacy, saying it had slowed its pace of scaling, implemented a two-week pause in reinforcement learning, and will be offering zero data retention for \u201celigible API customers.\u201d<\/p>\n

In its first announcement<\/a>, issued Tuesday, OpenAI said it \u201ctemporarily\u201d slowed the pace of its scaling, in addition to pausing reinforcement learning training.\u00a0<\/p>\n

Those efforts occurred while OpenAI hardened and red-teamed its research environment and expanded monitoring, it said, adding, \u201cour largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding.\u201d<\/p>\n

OpenAI\u2019s statement said the company will \u201cnow require stronger evidence of aligned behavior throughout all of training, building on research and evaluations already underway. Keeping increasingly capable systems aligned is a challenge the whole field will need to address.\u201d<\/p>\n

It also highlighted other recent efforts to improve its procedures, including workload isolation, network isolation and \u201ccontinuous security testing.\u201d<\/p>\n

However, the company noted that its newly proposed monitoring will generate overhead costs of \u201croughly 20% of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads.\u201d It promised to share more details about this system in a forthcoming blog post.<\/p>\n

Analysts and consultants said that the moves were likely announced to position OpenAI better for an imminent IPO<\/a>.\u00a0<\/p>\n

Carmi Levy<\/a>, an independent technology analyst, viewed the statements as \u201ca slickly conceived move to win PR points as safety concerns around agentic AI continue to mount. It signals that the company is doing something<\/em>, even if that something is woefully inadequate. In the absence of explicit regulations forcing vendors like OpenAI to permanently prioritize safety above all other factors, a two-week pause is little more than window dressing designed to deflect criticism.\u201d<\/p>\n

Jason Andersen<\/a>, principal analyst at Moor Insights & Strategy, agreed, saying that he thought that \u201cthis is a little bit of pragmatic theater as they move into an IPO.\u201d But he suggested that there also may be more going on. Enterprises will continue to spend on AI aggressively, and \u201cit will be pedal to the metal until they get sued.\u201d Then they\u2019ll back away.<\/p>\n

However, he said, \u201cthe only way that these [large AI] companies are going to be successful post-IPO, the only way to scale, is to get much deeper into enterprises. And the only way to do that <\/em>is to alleviate fear and risk.\u201d<\/p>\n

Zero data retention?<\/h2>\n

In Wednesday\u2019s announcement<\/a>, OpenAI didn\u2019t say what constitutes eligibility for the zero data retention program, only that it would start in September, when the company would share details in a \u201ctechnical white paper.\u201d<\/p>\n

But Andersen said that this move has to be viewed in the context of today\u2019s complicated vendor relationships.\u00a0<\/p>\n

Much of OpenAI\u2019s revenue is not direct from the enterprise, but through partners like Microsoft and AWS, he pointed out. \u201cSo let\u2019s say I use a tool like Amazon Kiro, which can use OpenAPI via API to build my app without my knowledge of the model. It sounds like Amazon is the customer and you are Amazon\u2019s customer. If you are an enterprise and want this [zero data retention] protection, you must provide your own API key to Kiro. The enterprise just becomes the direct customer and now gets the lockbox access. AWS no longer has access and loses out on revenue\/margins.\u201d<\/p>\n

Consultant Brian Levine<\/a>, executive director of FormerGov, added that the data retention promise is also complicated by how processes tend to function.<\/p>\n

\u201cOpenAI says it can now monitor for abuse across interactions without any staff ever reading the underlying content,\u201d he said. \u201cThat is a strong technical promise, because watching for misuse and not being able to see the data have historically pulled in opposite directions. And the proof is a white paper that is still weeks away.\u201d<\/p>\n

In addition, he noted, \u201cZero is never quite zero because CSAM-flagged content is still retained for legal reporting.\u201d<\/p>\n

Flavio Villanustre<\/a>, CISO for the LexisNexis Risk Solutions Group, saw the move somewhat differently, suggesting that it was designed to soften possible legislation.<\/p>\n

\u201cIt is likely that they are seeing the writing on the walls about upcoming regulations that could have a significant impact on them, and this could be their attempt at showing a desire to self-regulate to avoid a more draconian legislation in the future,\u201d Villanustre said.\u00a0<\/p>\n

Still, Mike Wilkes<\/a>, enterprise CISO at Aikido Security, observed, \u201csincerity is not the same thing as permanence. In the old Norse\/Scandinavian image of a giant sea monster waiting beneath the surface, you might call this \u2018Pause the Kraken.\u2019 The real question is what conditions have to be met before OpenAI decides to release it again.\u201d<\/p>\n

Added Justin St-Maurice<\/a>, technical counselor at Info-Tech Research Group, OpenAI seems to want credit for doing the bare minimum of what a major AI firm should have always done.<\/p>\n

\u201cIf a carmaker announced that it was going to take basic safety testing more seriously before production, it wouldn\u2019t be to fanfare. Frankly, it would be embarrassing that something so fundamental needed clarifying to a skeptical public,\u201d he said. \u201cThe question for me is why this needs to be an announcement now, and whether they hold the line once a competitor ships something that makes a pause expensive.\u201d<\/p>\n

Thus, he advised, \u201cstop treating these announcements as diligence. Ask for the evidence of what you\u2019re actually getting, not what you\u2019ve been promised. If a vendor can pause development for security reasons, and the way you found out was through a blog post, then you should be asking what your contract requires them to disclose to you.\u201d<\/p>\n

This article originally appeared on Computerworld<\/a>.<\/em><\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

OpenAI this week announced multiple moves designed to counter negative perceptions of its security and privacy, saying it had slowed its pace of scaling, implemented a two-week pause in reinforcement learning, and will be offering zero data retention for \u201celigible API customers.\u201d In its first announcement, issued Tuesday, OpenAI said it \u201ctemporarily\u201d slowed the pace […]<\/p>\n","protected":false},"author":0,"featured_media":9195,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9194","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9194"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9194"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9194\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9195"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}