90 incidents on record · 2026 Headlights Incident reports by Ellie Harris · Melbourne
10 new this week Library last updated 13 July 2026
← The incident library
HD-INC-056
Media · United States · 2023 · Training-data provenance

The New York Times sued OpenAI and Microsoft, alleging their models were trained on its articles and could reproduce them almost word for word

By Ellie Harris · Filed Complaint filed 27 December 2023 (SDNY)

Alleged: OpenAI; Microsoft developed or deployed the AI system implicated in this incident. Details are drawn from public reports; parties are presumed innocent of any wrongdoing not established by an official finding.

The New York Times sued OpenAI and Microsoft, alleging their models were trained on its articles and could reproduce them almost word for word

What happened

On 27 December 2023 The New York Times filed suit in the Southern District of New York against OpenAI and Microsoft, alleging that the companies had used millions of its articles, without permission or payment, to train the large language models behind ChatGPT and Microsoft’s Copilot. The complaint went beyond the general claim that copyrighted text had been ingested. It included examples in which, the Times said, the models reproduced its articles at length and close to verbatim, returning passages a reader could have found behind the paper’s paywall. The suit framed this as both unlawful copying at training time and unlawful reproduction at output time, and asked, among other remedies, for the destruction of models trained on its work.

OpenAI and Microsoft deny the claims. Their defence rests substantially on fair use, the argument that training a model on copyrighted text to build a new, general-purpose system is transformative, and they have characterised the near-verbatim reproductions as the product of atypical prompting rather than ordinary use. The case has become the most closely watched of the wave of copyright actions brought against AI developers, because the questions it raises, whether training on copyrighted work is fair use, and whether a model reproducing that work is infringement, sit at the centre of how these systems were built.

The litigation has moved, without yet resolving the merits. In April 2025 Judge Sidney Stein largely denied the companies’ motions to dismiss, allowing the core copyright-infringement claims to proceed while trimming some secondary claims, and rejecting the argument that the Times had sued too late. Discovery has been contentious: a magistrate judge, Ona Wang, ordered OpenAI to preserve ChatGPT output logs on a scale without real precedent, reaching hundreds of millions of users, so that evidence of what the system actually produces could not be lost, and that order was upheld over OpenAI’s objection. The Times has refined its complaint as the law shifted, narrowing one theory against OpenAI while pressing its claims against Microsoft’s role. As of mid-2026, summary-judgment briefing has concluded and the case awaits the court’s rulings, with no trial date set. Nothing here is a finding of wrongdoing; it is a live dispute whose outcome is unsettled.

What an auditable version would have shown

Two questions run through the case, and both are, at bottom, questions about records that were not kept in a form anyone outside the company could check. The first is provenance: what, exactly, went into the training corpus, and under what rights. The second is reproduction: how often, and under what conditions, the deployed model returns text that is substantially a copy of a specific copyrighted work. Much of the litigation is an effort to reconstruct, through discovery, answers that a different design would have had on hand.

An auditable version treats both as recorded facts. On the way in, a provenance record captures the sources of training data and the rights associated with them, so that “was this publication’s work used, and on what basis” is answerable from a log rather than inferred from the model’s behaviour. On the way out, a check at the point of generation can compare an output against protected works and record when the system reproduces one at length. With those records, the central factual disputes, what was ingested, and whether the system regurgitates it, become matters of evidence the builder can produce, rather than questions a court must extract through a preservation fight.

Where the gap was

The gap is that systems trained on vast bodies of text were built without a durable, checkable record of what that text was and what rights attached to it, and without a control at output that registers when the model emits a near-copy of a specific protected work. Whatever the courts ultimately decide about fair use, the absence of those records is what makes the questions so hard to answer and so expensive to litigate.

An EgressGate is the control at the boundary where output leaves the system: it classifies what is about to be produced and can catch the case where a generation reproduces protected content substantially, rather than letting verbatim regurgitation be discovered by an adversary’s prompt. A ConductRecord is the control on provenance and on the outputs themselves: a record of what a model was trained on and what it generated, so that the two questions at the heart of the dispute can be settled against evidence instead of reconstructed years later.

What governance should have looked like

The pattern is general: when a system is built on data whose provenance was never recorded, and ships without a record of what it produces, the accounting that should have existed by design has to be assembled by subpoena. Provenance and egress are cheaper to record than to reconstruct, and far cheaper to record than to litigate.

The reference implementation of EgressGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.

Sources

The mailing list

Fresh incident reports every week. One email to match.

We add new incidents to the library regularly, and send a single short email each week with what's new. The library stays free and open; this is just how you keep up with it.

No tracking. Unsubscribe in one click.

The record

An auditable system would have produced a signed, tamper-evident record the moment this happened: what the system did, the version that did it, the basis it acted on, and the action taken, and OpenAI; Microsoft could have produced it on demand.

This is the record the system as deployed did not produce in a signed, auditable form.

What this teaches
Capture what happened when it happens
What the system did, the version that did it, the basis it acted on, and the action taken, recorded at the moment, not reconstructed after.
Sign it, so no one has to trust the record-keeper
A tamper-evident entry. Edit it later and the signature breaks. The record does not ask for the benefit of the doubt.
Make it verifiable by anyone
A court, a regulator, a customer's lawyer can check the record themselves, without taking the company, or us, at our word.

Headlights summarises publicly reported AI incidents. All summaries are independently written, attributed to their original sources, and intended for research and educational purposes. Allegations are identified as such until established through official findings.

Last reviewed June 2026. This report is based on the sources listed above and reflects information available at the time of review; later developments may not be captured. Where a person is described as charged with or alleged to have done something, that allegation is unproven unless a conviction or a court or regulatory finding is stated. Headlights publishes journalism and commentary, not legal advice.

Want to write back?

Direct to my inbox.

ellie@useheadlights.com →