On September 23, Anthropic announced that its Claude agents had combed through a huge pile of DNA sequences and turned up a new enzyme system. The company named it ART.
A few days later, Mario Rodríguez Mestre, a computational biology PhD student at the University of Copenhagen, spoke up. He said he and his colleagues had been working on this kind of enzyme since 2022, and that what Claude reported overlapped heavily with their work. The part that made people uneasy came next. For years his group had used Claude for research tasks, and they had pasted unpublished material into it.
He did not accuse Anthropic of taking anything. According to China's Science and Technology Daily, he said he couldn't be sure and had no evidence. Anthropic said it hadn't known that anyone had described the same finding, and that Claude isn't trained on user conversations.
Nothing has been settled. But I suspect a lot of people reading the news had the same reflex I did. You think back to whatever you pasted into a chat window last month, and you wonder which server it's sitting on now.
Two collisions in five weeks
ART isn't the only case. Science and Technology Daily reported on October 20 that at least two similar episodes had happened over the previous five weeks.
The other one was in mathematics. NYU mathematician Tristan Buckmaster had spent a year on the Navier-Stokes problem with Levent Alpoge, a mathematician at Anthropic. On September 7, Buckmaster posted an update along with a paper solving a simplified version of the problem. The next day, OpenAI announced that its AI agent had solved the problem.
Buckmaster asked almost the same question Mestre did. Could what they had typed into OpenAI's tools have been used for training? OpenAI said no. Before the result went public, it said, none of its researchers or agents had seen that material.
Both companies deny it, and neither scientist has evidence. But once that kind of doubt shows up, it's hard to put back.
Some scientists, worried that AI might walk off with their unpublished work, have started using these tools less.
How ART was actually found
It helps to know how the discovery happened before arguing about it.
According to a September 28 report in the same paper, the humans gave only a fairly broad search direction, and Claude did most of the rest. About 950 agents ran for 21 hours and used roughly 210 million tokens. They started from nearly 200,000 reverse transcriptases, picked out about 3,500 candidate systems, then narrowed those down to 20 priority targets.
One agent noticed that next to an uncommon phage reverse transcriptase sat a run of evenly spaced repeated DNA, a bit like CRISPR. Following that lead, the researchers confirmed a three-part system: a reverse transcriptase, a companion gene whose function is still unknown, and a CRISPR-like repeat array.
The wet-lab work was done by people. It showed that the array is expressed and produces a set of distinct short RNAs. What it does inside the cell, and whether it could ever be used for gene editing, nobody can say yet. The report is explicit that it shouldn't be treated as a gene-editing tool for now.
So the split looked roughly like this. AI searched, filtered and proposed hypotheses. Humans checked them at the bench. Anthropic says this way of working can shrink analysis that would normally take weeks or months down to a few hours.
Twenty targets out of 200,000, in 21 hours. For a lab of three or four people, that could easily be most of a year.
That speed is exactly why Mestre's complaint stings. A direction his group had spent years on got swept up in a day.
We all do the same thing every day
Swap the scientists for ordinary office workers and the story gets a lot closer to home.
A grad student pastes results that haven't been submitted yet into a chatbot to polish the discussion section. A founder uploads an entire pitch deck and asks whether the valuation logic holds up. A paralegal drops in a case summary to build a timeline. An HR manager uploads twenty résumés and asks for a ranking against the job description.
All of this is convenient, and it really does save time. The trouble is that when most of us hit send, we don't know what happens to the file next. How long is it kept? Who can see it? Does it end up in training data? Who's responsible if something goes wrong?
Researchers care about this more than most, for a simple reason. In science, getting there first is close to everything. Publish an idea three months late and you can go from discoverer to follower, and your papers, grants and promotion prospects shift with it.
Scientists are already changing their habits
The October 20 report described what a few scientists now do, and some of it is worth borrowing.
Sandra Laurentino, a reproductive epigeneticist at the University of Münster in Germany, now uses AI only to find bugs in her code. Before she does, she renames parameters and variables to generic labels, so the system can't tell from the names what experiment she's running.
| Scientist | What they do | Why |
|---|---|---|
| Sandra Laurentino (U. Münster) | Uses AI only for bug-finding; renames variables to generic labels first | So the system can't infer the experiment from names |
| Samuel Mehr (U. Auckland) | Bans students from uploading protected data; avoids commercial models at every project stage | Can't verify how a third party handles it, so it's a real IP risk |
| Wellcome Trust and other funders | Ban reviewers from uploading confidential grant applications to AI | One upload by a reviewer exposes an applicant's unpublished idea |
Which means being careful yourself isn't enough. You can guard your work closely, and then a reviewer pastes your manuscript into a chat window and all that care goes out the door.
What the "don't train on my data" switch actually covers
A lot of people's peace of mind rests on one setting: don't use my data to improve the model. You should opt out. But the setting covers less than most people assume.
Even if users opt out of training, or don't use these systems at all, their information isn't necessarily safe.
David Krueger, founder of Evitable
Here's one way to think about it. Training means blending your content into the model, and opting out means it doesn't get blended in. That's all. Whether your data is stored on a server, for how long, whether it shows up in logs, whether a person might read it during a safety review, what happens when a court asks for it, what happens if the provider gets breached: the training setting controls none of that. Policies also vary by company, and the terms for consumer, team, enterprise and API products often differ.
If you actually want to know, the only reliable way is to read the privacy policy and data retention terms for the exact product and plan you use. It's tedious work. It still beats guessing after the fact.
Even if nothing leaks, AI may still get there first
Two things need to be kept apart here, or the whole argument turns to mush.
One is a data leak, where your material gets used by someone else. The other is AI reaching your answer before you do, using nothing but public information.
Some people think the second will keep happening more often. Geoffrey Irving, chief scientist at Resolution, an AI safety research group in Berkeley, California, argues that even if AI never touches anyone's private data, the ocean of public literature humans have built up is big enough for it to keep finding new things. As its reasoning gets better, scientists may find again and again that AI got there first.
Looking at 2026 so far, that doesn't sound far-fetched. An October 16 report in Science and Technology Daily laid out the year. In May, Nature published papers on Google DeepMind's AI co-scientist system and FutureHouse's Robin. In July, Phylo's Biomni agent designed a complete plasmid insertion protocol on its own. Researcher Yuanhao Qu said it handled the whole process from start to finish, though it still couldn't operate the lab equipment itself.
The same report had a detail I keep coming back to. A researcher gave the Kosmos system a dataset with 30 million rows. At first it ignored one of the columns entirely. Only after someone pointed that out did it go back, and then it found a new feature of cancer cells.
AI can work through data at a scale no person can match. What it pays attention to and what it skips still needs a human watching.
So what's left for people?
From October 17 to 19, the second International Conference on AI Scientists ran for three days, and this question kept coming up.
According to the October 20 report, Nobel chemistry laureate Michael Levitt, now 79, started using ChatGPT a few days after it launched and now runs six agents at the same time. His view, as reported, is that AI for Science is at heart AI that serves scientists.
AI has the answers, people have to ask the questions. A good question is now worth more than the ability to carry out the work.
Michael Levitt, Nobel laureate in chemistry
Turing Award winner Jack Dongarra warned young researchers that AI can't do everything, and urged them to keep studying math. Someone at the conference also brought up an awkward fact: some models have churned out large numbers of unverified, low-quality math papers. Being able to tell whether what AI hands you is right is turning into a real skill.
Sara Hooker, co-founder of the startup Adaption, made a similar point. AI agents still aren't good at asking the kinds of questions that drive discovery. Setting direction and forming hypotheses still falls mostly to people.
That's reassuring at first. Turn it around, though, and it's a little unsettling. If the most valuable thing is asking the right question, then your questions, meaning your unpublished ideas, are exactly what most needs protecting. What you paste into a chat window usually isn't an answer. It's the question you've been chewing on for months.
Sovereign AI, in plain English
"Sovereign AI" gets used a lot these days, and it sounds like something for national governments. For a lab or a company, it boils down to three plain questions.
Whose machine is the data stored on? Whose compute does the work? And who makes the rules, such as when things get deleted, whether the model gets swapped out, and who can see the records? These three questions line up with the data, compute, model, and identity framework laid out elsewhere: can you actually say which machine your work runs on and whose rules govern it.
If you use a large model on a public cloud, most of those answers sit with the provider. That doesn't mean the provider will misbehave. It means you can't check for yourself, so you have to trust them. For public material and everyday writing, that's completely fine, and cheap and convenient should win. For unpublished data, core formulas, customer lists or contracts still under negotiation, "just trust them" isn't really enough.
The most direct way to take those three things back is local or private deployment. The model runs on your own machines or inside your own network, files don't leave, you keep your own logs and you delete what you want. The costs are real too. You need hardware, someone has to maintain it, and local models usually lag the strongest cloud models by a step.
So the practical answer is often a mix. Sensitive work runs locally, and public work goes to the cloud. This is really just routing by task — which model handles a job depends on how sensitive the data is, not on which model is getting the most attention this week.
How to do this with KarmaBox
Go back to the grad student from earlier. They want AI to read a few dozen papers, sort out lab notes and draft the discussion section, but they don't want to hand unpublished data to a third party. KarmaBox treats "can I use AI for this" and "where does my data live" as two separate questions. Sensitive material stays on your own devices and network, and you can still call cloud models for public material — which is exactly what a local-first workspace is supposed to look like.
Specifically, KarmaBox lets you put lab notes, internal documents and unpublished manuscripts into a knowledge base on your own device. The AI organizes them into a searchable library, and questions are answered locally, so you don't have to paste the original text into an outside service every time. The same interface connects Chinese models, international models and locally deployed models, so you can use a local model for sensitive data and a stronger cloud model for searching public literature or polishing your English, all within the same workflow. It also supports local or private deployment, so core data stays inside your network, and you can set up several avatars with different jobs, for example one that tracks new papers in your field and one that organizes your group's files, paired with scheduled tasks that send summaries on time.
One caveat: running models locally takes real hardware. Before you deploy, check which models your machines can handle, and how fast, given your data volume.
A few things you can do today
Whether or not you go local, these habits are worth building. None of them is hard. Sticking with them is the hard part.
Start by sorting your data into tiers. Mine are rough, just three. Public material, use freely. Internal material, think before you use it, ideally with an enterprise plan or a local model. Anything unpublished, anything involving other people's private information, anything under an NDA, as a rule doesn't go into any outside AI. Rough tiers are fine. What matters is having that check in your head before you hit send.
When you do use outside tools, borrow Laurentino's trick. Gene names, sample IDs, client names and project code names all get swapped for generic labels first. Don't forget variable names in your code. Plenty of people clean up the text and leave the species and treatment conditions sitting right there in the variable names.
Spend ten minutes going through the settings of the AI tools you use most. Where is the training setting? How long are conversations kept? Can you delete them in one step? How do team and personal plans differ? If there's a clause you don't understand, write it down, ask support, and get the answer in writing.
One more that people overlook is timestamping your ideas. When two groups collide, it often comes down to who can prove they were earlier. Date your lab notebook entries, email key ideas to yourself, commit code to version control regularly, and post a preprint when it makes sense. These records seem useless most of the time. When things get murky, they're what you stand on.
And if you review papers or grant proposals, don't upload other people's manuscripts or applications to AI, even just to help you follow the argument. Wellcome has already banned it, and other funders will likely follow.
Frequently asked questions
1. Q: If I upload unpublished research data to an AI tool, will it definitely be used for training?
A: Not necessarily. It depends on which product and plan you use, and on your privacy settings. Many services let you opt out of training, and enterprise plans usually don't train on your data by default. But not training on your data isn't the same as not storing it. How long it's kept and who can access it depend on the terms of service.
2. Q: If I turn off "use my data to improve the model," am I safe?
A: It lowers some of the risk, not all of it. David Krueger, founder of Evitable, has pointed out that opting out of training doesn't guarantee your information is safe. Storage, logs, human review, legal requests and security breaches are all outside what that setting controls.
3. Q: In the ART case, did the AI use someone else's data?
A: There's no answer yet. Mario Rodríguez Mestre, the Copenhagen PhD student, says his team's work clearly overlaps with Claude's finding, but he has also said he has no evidence the company used it. Anthropic says it didn't know about the earlier work and that Claude isn't trained on user conversations.
4. Q: Will AI take credit for scientific discoveries?
A: There are two different risks. One is a data leak, which you can guard against by managing your data carefully. The other is AI getting to the answer first from public literature alone. That's closer to competition, and you can't really prevent it. You can only record your work earlier, publish faster and get better at asking questions.
5. Q: Does a small team really need local deployment?
A: It depends on the data. If you mostly work with public material, cloud tools plus careful anonymization are enough. If you regularly handle unpublished data, pre-patent technical work or customer privacy, local or private deployment is worth costing out properly, including hardware and maintenance.
Final thoughts
The ART dispute will most likely fizzle out, like plenty of priority fights before it. The question it raised won't. The more capable AI gets, the more we're willing to hand it, and the more valuable the things we hand over become.
Working out what you can share and what has to stay with you is going to be a basic skill for anyone doing research or running a business. Before you log off tonight, scroll back through what you've uploaded lately and see whether any of it shouldn't have gone out.
Ask where it's going before you decide whether to send it.