# Microsoft's own memo on AI training just went public.

Published: 2026-09-18

Unredacted filings in New York Times v. OpenAI & Microsoft: a Microsoft director's January 2023 memo calls AI training data "the largest theft of labor in human history", Copilot cut click-throughs to the Times by up to 93% (his "doom loop"), Nadella says paywalled content should be licensed, ChatGPT's head calls the product "largely substitutive", and Greg Brockman answered a paywall hack with "ah nice." Same day: OpenAI ships Astra for Law (54% correct on the Vals legal bench). Plus ZCode uploading your whole .git to Aliyun with a key only Z.ai holds, and Hacktron reaching OpenAI's internal repos for a $6,500 bounty. Verdict: NEEDS REVIEW.

Canonical: https://thedailydiff.dev/video/2026-09-18-theft-of-labor/

## What this video covers

- NYT v. OpenAI/Microsoft unsealed: "largest theft of labor in human history" (Microsoft memo, Jan 2023); Copilot −93% click-throughs; 91,692 copies of plaintiffs' works in mid-training data; 2M nytimes.com pages in one Common Crawl slice; copyright notices stripped; Brockman: "ah nice"
- Caveat: quotes come from the Times' brief, exhibits still sealed; Judge Alsup (Bartz v. Anthropic) ruled training on bought books is fair use — Anthropic paid $1.5B for the 7M pirated ones
- OpenAI Astra for Law: GPT-6 Astra + a 230M-URL legal index; 54.0% vs 38.7% on Vals Legal Research Bench; Harvey, Legora, 26 plugins
- ZCode (Z.ai, GLM): 313 MB encrypted snapshot of a 42,411-file workspace, 86.6% .git, uploaded to Aliyun OSS on login and before every prompt; RSA-OAEP key held only by Z.ai; settings toggles don't stop it
- Hacktron: libheif heap overflow → Discourse RCE → SSO misconfig → GitHub → OpenAI internal repos in under 72 h; exploit by Claude Opus 5 (3 h); campaign under $3,000 in tokens; bounty $6,500, patched in ~14 h

## Transcript

0:00 In January 2023, a Microsoft director wrote a memo calling what his own company was doing the largest theft of labor in human history, and yesterday a federal court let the rest of us read it. The memo is one of the unredacted quotes in New York Times versus OpenAI and Microsoft, a lawsuit that turns three this December. The same Thursday, OpenAI shipped Astra for Law, a model for lawyers, which is either a coincidence or a very strong hire. This morning a developer caught ZCode, Z dot A I's coding agent,

0:29 uploading his entire git history to Alibaba's cloud with a key only Z dot A I holds. And a security firm walked into OpenAI's internal repositories through an image upload, for which OpenAI paid six thousand five hundred dollars. In this video: what the filings say, who said ah nice to a paywall hack, the law model that is wrong half the time, what ZCode uploads, and why a Claude-written exploit is worth less than a used car. It's Friday, September 18th, and this is The Daily Diff.

0:58 Start with the memo. Brent Hecht runs applied science at Microsoft, and in January 2023 he called the training data an astonishing theft of unprecedented proportions. A year later he was back with a slide deck: Copilot's answer engine cut click-throughs to the Times by up to ninety-three percent, which he named a doom loop: starve the publishers, and the model has nothing new to eat. His words: an end product that threatens the economic foundations of its

1:21 essential suppliers, the corporate way of saying the snake has located its tail. Then the depositions. Satya Nadella testified this year that anything paywalled should be licensed, and that had he known OpenAI trained on paywalled articles he would have made them retrain, which assumes nobody at Microsoft opened the training set they were handed, and per the same filing that was the entire GPT-3 dataset. Nick Turley, who runs ChatGPT, called it an existential threat to publishers, largely substitutive. And when a researcher

1:49 told Greg Brockman about a hack to get around the Times paywall, the president of OpenAI replied with two words: ah nice. Engineers also stripped copyright notices out of the data so the model wouldn't output them, which is why you file the serial number off a bicycle. The scale: more than ninety-one thousand copies of the plaintiffs' articles in the mid-training sets alone, and two million Times pages in one Common Crawl slice. Now the part the headline skips.

2:15 Every quote comes from the Times' brief; the exhibits are still sealed, so we are reading the prosecution's highlights without context. And courts have mostly sided with fair use: Judge Alsup ruled last year that training on books you paid for is legal, though Anthropic still paid one and a half billion for the seven million it pirated. So the legal question is open. Whether the people building it thought it was theft is, as of yesterday, not.

2:41 Which makes Thursday's other OpenAI launch a bold choice. Astra for Law wraps GPT-6 Astra, the model I stamped REVERT last week after it produced seventy-five thousand lines of nothing, in a legal search index of two hundred and thirty million pages. On Vals AI's legal research benchmark it passes fifty-four percent of questions, up from thirty-nine with plain web search, which OpenAI calls a forty percent improvement and a lawyer would call wrong nearly half the time. The blog post does not contain the word hallucination.

3:14 Hacker News did: will it be able to sue itself, which, given the week, is the first genuine use case. Meanwhile the theft-of-labor discourse reached your laptop. A developer called ferstar cleaned out his ZCode folder, Z dot A I's closed desktop agent for the GLM models, and found a three hundred and thirteen megabyte encrypted archive of his commercial workspace: forty-two thousand files, eighty-seven percent of it the dot git directory, shipped to Alibaba's object storage on login and before every prompt.

3:42 The archive is wrapped with a public key the server hands out; the private key lives only in Z dot A I's cloud, so the ciphertext on your own disk is unreadable to you. His line: a key that only the server can use serves exactly one purpose. Z dot A I is also the company Anthropic accused of distilling Claude, so the weights are open and so, apparently, is your repo. And the funny one, unless you work at OpenAI. Hacktron found a heap overflow in libheif, uploaded a crafted picture to

4:10 community dot openai dot com, got code execution on the forum, and rode a misconfigured single sign-on through the GitHub integration into OpenAI's internal repositories, in under seventy-two hours. The exploit was written by Claude: Opus 4.8 could not beat address randomisation, Opus 5 did it within three hours of release. The whole campaign cost under three thousand dollars in tokens. OpenAI patched in fourteen hours and paid six thousand five hundred dollars, so the source code of a trillion-dollar company was,

4:39 briefly, priced like a used Corolla, on the same day its lawyers argued that copying is fair use. If you'd rather read this than hear me say it, the diff lands in your inbox every morning — free at the daily diff dot dev, link below. So — today's verdict: needs review. The quotes are real, but they are the prosecution's picks from sealed exhibits, and the one judge who has ruled says training is fair use and piracy is not. The court decides the law; the memo already decided the ethics.

5:07 Subscribe, hit the bell, and tell me in the comments if you'd have stamped it differently. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

## Sources

- [TechCrunch: Microsoft exec called AI scraping 'the largest theft of labor in human history'](https://techcrunch.com/2026/09/17/microsoft-exec-called-ai-scraping-the-largest-theft-of-labor-in-human-history-new-unredacted-filings-reveal/) — techcrunch.com
- [HN thread (605 pts)](https://news.ycombinator.com/item?id=49752056) — news.ycombinator.com
- [Jason Kint on the unsealed motions](https://x.com/jason_kint/status/2100611139906228629) — x.com
- [Ed Newton-Rex](https://x.com/ednewtonrex/status/2100649215290466631) — x.com
- [Bartz v. Anthropic / $1.5B settlement (background)](https://en.wikipedia.org/wiki/Anthropic) — en.wikipedia.org
- [OpenAI: Introducing Astra for Law](https://openai.com/index/astra-for-law/) — openai.com
- [HN: Astra for Law (550 pts)](https://news.ycombinator.com/item?id=49745940) — news.ycombinator.com
- [ferstar: ZCode silent workspace snapshot (original forensics)](https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot/) — blog.ferstar.org
- [tokenstead write-up](https://tokenstead.ai/guides/zcode-silent-git-history-upload) — tokenstead.ai
- [ferstar on X](https://x.com/ferstar_org/status/2100805861002355154) — x.com
- [HN: ZCode uploads your Git history (226 pts)](https://news.ycombinator.com/item?id=49752422) — news.ycombinator.com
- [Hacktron: Hacking OpenAI](https://www.hacktron.ai/blog/hacking-openai) — www.hacktron.ai
- [HN: Hacktron (406 pts)](https://news.ycombinator.com/item?id=49749656) — news.ycombinator.com