The threat report is also a disclosure document

OpenAI's June 2026 Threat Report says it caught a PRC-linked network using ChatGPT to seed two narratives into US public debate: that AI data centres would raise household power bills, and that ChatGPT had leaked user data.¹ The first is a policy attack on the AI build-out. The second is a reputational attack on OpenAI. I want to focus on the second, because the structure around it tells us something about who these reports are actually for.

The headline framing is straightforward: a company found state-linked actors abusing its platform, banned them, and told the public. That is, on its face, the kind of disclosure we want platforms to do. I am not going to argue otherwise. What I want to argue is that the disclosure regime around it, recurring threat reports, proprietary severity ratings, in-house attribution, is doing more than one job at once, and the job we are paying least attention to is the one most likely to shape it over time.

The user is not the audience. Think about who the fabricated data-breach story was aimed at. Not policymakers, who have their own briefings and don't form views about OpenAI's security posture from anonymous social-media claims. It was aimed at ordinary ChatGPT users — the people with the least visibility into how the platform handles their data, and therefore the people whose trust is easiest to dislodge. That is a real harm. It is also, importantly, a harm that gets resolved entirely inside OpenAI's own walls.

OpenAI detected the operation. OpenAI assessed it. OpenAI assigned it Category One on the Breakout Scale, a severity tier defined by a rubric OpenAI publishes but no outside body audits.¹ OpenAI attributed it to PRC-origin actors. OpenAI decided what to disclose, and chose to frame the operation by analogy to PRC influence campaigns against rare-earths companies pursuing supply-chain decoupling.¹ Every load-bearing claim in the story — that the operation existed, that it came from where OpenAI says it came from, that it was as serious as OpenAI says it was, that the response was adequate — depends on trusting the entity whose reputation the operation was attacking.

This is not a new structural problem. Meta's and Twitter's disclosures of state-linked operations between 2016 and 2020 were treated at the time as evidence of platform accountability. Subsequent academic audits, most thoroughly by the Stanford Internet Observatory, found those disclosures were uneven, partial, and shaped by what the companies wanted the public conversation to be about.² The platforms were not lying. They were curating. The curation went unchallenged because no one outside the company had the access to challenge it.

The cadence is doing work. OpenAI has published threat reports on a recurring schedule now. Each one is reported as news. Each one demonstrates that the company has a process — a team, a rubric, a severity scale, a willingness to attribute. The cumulative effect is the appearance of a mature governance function. I want to be careful here: the function may genuinely be maturing. People inside the trust-and-safety team are doing real work, and that work matters. But the reports are also, by now, plainly serving a second audience.

OpenAI is moving toward an IPO. Threat reports, published at a regular cadence with named adversaries and quantified severity, are exactly the kind of document that demonstrates to investors and regulators that a company has institutional capacity to handle adversarial risk. They read as disclosure-ready. They are practice for the disclosures that come after listing. None of this is sinister; it is what companies of this size do. But it changes how to read the artefact. A document that performs two functions, public-interest reporting and investor-facing risk demonstration, will be shaped by both, and where the two pull in different directions, the second usually wins, because the second has a price.

The rare-earths move. The most consequential paragraph in the report is the analogy to rare-earths companies.¹ By drawing it, OpenAI is making a claim about what kind of thing it is. Not a consumer product, not a software vendor, but a piece of strategic infrastructure in a great-power technology competition. That framing is partly accurate — frontier AI labs are clearly contested terrain. It is also extremely useful to OpenAI. Critical-infrastructure framings underwrite a particular kind of opacity. They make "national security considerations" available as a reason not to answer questions. They reposition users from customers, to whom the company owes service, into civilians in a conflict, to whom the company owes protection on terms the company defines.

I do not think OpenAI is wrong that state-linked actors are targeting it. The CSET work on AI capability diffusion suggests the rare-earths analogy overstates how indispensable any single provider is — capability is spreading fast across labs and jurisdictions, which is the opposite of how rare-earths concentration works.³ But the geopolitical contest is real, the targeting is plausible, and the underlying operations described in the report are consistent with what other researchers have documented about PRC-origin influence campaigns. That is not the question. The question is what governance arrangements should follow from accepting it.

What independent verification would look like. Right now: nothing. There is no body that audits OpenAI's attribution methodology, no standard against which Category One can be checked, no requirement that a sample of banned accounts be made available to outside researchers under a confidentiality regime. The 2016-2020 platform-disclosure cycle ended with academic researchers developing exactly these tools for Meta and Twitter, mostly without the platforms' cooperation, and mostly too late. The same trajectory is now visible for frontier AI. There is no reason to repeat it.

The users whose trust was the target of this operation had no voice in any part of the response. They will be told a story about it, by the company whose reputation depended on the story landing well. That is not a scandal. It is the default, and the default is what changes only when someone insists it should.

I am not asking OpenAI to stop publishing threat reports. I am asking us to read them for what they are: a company telling us, on its own authority, what happened to it and how serious it was, at a moment when the company has strong reasons to want the telling to go a particular way. That is worth something. It is not worth as much as a disclosure regime with an outside party in the room. The gap between the two is where the next decade of platform governance gets decided.

Footnotes

¶