The policy took effect on June 9, 2026. On June 10, Microsoft limited employee access to Claude Fable 5 while its legal teams read the terms, according to reporting on the retention change. One day. That is how fast a data-handling clause can turn a frontier model from an approved tool into a blocked one.
What Anthropic did was narrow and defensible. What it broke was a contract term that a lot of regulated buyers had treated as settled.
The clause that stopped being available
Anthropic’s own data retention page for covered models is unambiguous: “Prompts submitted to, and outputs generated by, covered models are retained for 30 days to support our safety work, on every platform where these models are offered.”
Covered models means the Mythos-class tier and anything later with comparable capability. Claude Fable 5 and 5.1 sit inside that definition because they share an underlying model with Mythos 5 and 5.1, with extra safeguards layered on for cyber and biological domains. Consumer plans are untouched, since Free, Pro and Max already retained data under existing terms.
The organisations it actually hit are the ones that had negotiated zero data retention: Console workspaces on ZDR, Claude Code with ZDR on Enterprise, and anyone reaching Claude through AWS Bedrock, Google Cloud Agent Platform or Microsoft Foundry under a ZDR arrangement. For those buyers, “nothing is stored” was not a preference. It was frequently the specific sentence that got the tool through legal review in the first place.
Anthropic did put real controls around the retained data. By default no Anthropic personnel can read it; access requires either an automated safety flag or a legal obligation, and every access is written to what the company describes as a tamper-proof log that reviewers cannot suppress or modify. Deletion is automatic at 30 days unless something is flagged or legally held.
That is a good design. It is also not the same promise, and procurement teams do not grade on effort.
Why they wanted the logs
The security argument is the strongest part of this story, and it is worth taking seriously rather than treating as cover for data collection.
Anthropic’s stated reason is that the retained data “will help us defend against complex and novel attacks (including new jailbreaks and attacks that operate across many requests) as well as help us identify and reduce false positives.”
The operative phrase is “across many requests.” A single prompt and its response can look entirely benign in isolation. An attack assembled over forty turns, where each turn is individually unremarkable, is invisible to anything that only inspects one exchange at a time. Detecting that class of attack requires state, and state means storage.
OpenAI’s head of product policy, Aleah Houze, made the identical observation from the other side of the argument, telling Axios that risks emerge “not just by looking at one single prompt and response pair, but when you look over time.”
Both companies agree on the threat model. They disagree on where the data has to live for anyone to act on it.
Two different answers to the same problem
On August 19, OpenAI previewed Private Safety Processing with early enterprise and API customers. The design goal is to spot misuse patterns across interactions while retaining none of the customer’s data: safety signals travel to OpenAI, the prompts and responses behind them do not, and the underlying data stays on customer-controlled infrastructure or under customer-controlled encryption keys. OpenAI told Axios it planned a wider rollout and technical documentation in September.
The day after that preview, Bloomberg reported Anthropic was preparing its own accommodation. Rather than abandoning the 30 days, the company would let enterprises hold the retained window in their own cloud infrastructure, with a rollout planned later in 2026. Anthropic had been working through the alternative with customers in heavily regulated industries.
Strip away the branding and both vendors have landed near the same architectural compromise: the safety system keeps its ability to reason across time, and the customer keeps physical custody of the bytes. The difference is which one gets described as a retention policy and which gets described as a privacy feature.
Neither is the thing a ZDR customer originally bought, which was the absence of the data entirely. The window did not close. It moved into your own building.
What to check before your next renewal
Three things are worth pulling up this week if you run AI procurement or you are the technical person legal calls.
First, find out whether your contract’s data-handling language is written against a vendor or against a model tier. Contracts that say “no customer data is retained by the provider” survive this change once storage shifts to your cloud. Contracts that assume the data never exists anywhere do not, and that distinction was academic until June.
Second, check whether your highest-capability tier and your default tier now sit under different terms. That is the genuinely awkward outcome here. A team can be compliant on one model and non-compliant on a more capable one from the same vendor, which is not a distinction most internal policies were built to express. Anthropic’s covered-model boundary is explicit about this, and it is the boundary to encode in your own tooling rather than the vendor’s name.
Third, decide what you actually want. A frontier vendor that can correlate a multi-turn jailbreak across a month of traffic is safer for everyone using the model, including you. A vendor that holds nothing cannot do that. If you push every provider to zero retention and they all comply, the class of attack that operates across many requests gets meaningfully cheaper to run. That tradeoff is real, and pretending otherwise makes for a worse negotiation.
The thing to watch through the rest of 2026 is whether customer-held retention becomes the default posture at the frontier tier. If it does, ZDR stops meaning “the data does not exist” and starts meaning “the data is ours.” Those are different products sold under one acronym, and the second one is going to need a new name before the next procurement cycle mistakes it for the first.