Safety Monitoring and Data Retention

Definition

Whether a frontier lab must hold customer prompts and outputs in order to detect misuse of its most capable models — and, if it must, for how long, under what access control, and with what right of refusal for the customer.

The question only became live when detection moved from per-request to cross-request. A classifier that scores a single prompt needs nothing after the request completes. Detecting a pattern across related interactions — the abuse shape both labs now say matters most at the frontier — requires comparing a request against others, which requires having kept them (source).

Zero Data Retention (ZDR) is the enterprise commitment that the provider keeps nothing after a request is processed. It predates this problem and was, until 2026, an ordinary procurement checkbox. The frontier-model safety case is the first thing to contest it.

Why It Matters

Two frontier labs have now taken opposite architectural positions on the same problem, within ten weeks of each other, and each says its position is required for safety:

	Anthropic	OpenAI
Position	retention is necessary for safety	retention is not necessary for safety
Mechanism	30-day retention of all Mythos-class traffic	Private Safety Processing — a narrow signal, no content exposure
Effect on a customer's existing ZDR agreement	voided for that traffic, no opt-out	preserved; ZDR granted on prior approval
Scope	all traffic, first- and third-party surfaces	eligible enterprise/API endpoints only
Status	in force since 2026-06-09; a change reported 2026-08-20, not yet shipped	previewed with early customers; rollout and white paper due September 2026
Consumer plans	unaffected — already retained	not covered
Sources:
(Anthropic),
(OpenAI),
(Anthropic change, reported).

The asymmetry in what each has shipped moved within twenty-four hours of this page being written, and the direction is the news. On 2026-08-20 Bloomberg reported that Anthropic plans to let enterprise customers hold the retained data on their own cloud infrastructure, with the 30-day requirement itself unchanged (source). Anthropic's side is therefore also a plan now — and it converges on the mechanism OpenAI previewed the day before, customer-controlled infrastructure.

What survives the convergence is the premise, and it is the thing worth tracking. Both labs still assert that frontier risk shows up across interactions rather than in a single prompt–response pair; both now propose that the customer can hold the content. The disagreement narrows from "must content be retained" to "who holds it, and what does the lab receive" — and neither has said what the lab receives. That is a smaller question than the one this page was created for, and a sharper one.

And the disagreement is technical, not merely commercial. Both labs accept the same premise — that frontier-model risk shows up across interactions rather than in a single prompt–response pair — and disagree about whether that premise forces content retention. Only one of them can be right, and the answer determines whether "zero retention" survives as a category for frontier models at all.

State of the Art (as of 2026-08-21)

Anthropic — a change reported, at the weakest tier of sourcing this wiki accepts. On 2026-08-20, Bloomberg reported — citing an unnamed source — that Anthropic plans to modify the June policy. Reported terms: enterprise customers still required to retain for 30 days, but given the option to hold that data on their own cloud infrastructure; rollout later this year; developed over months with more than 100 customers, including Salesforce, and with customers in highly regulated industries. Framed across outlets as a response to enterprise backlash (source).

No first-party Anthropic statement was surfaced by targeted search. This wiki's conflict rule ranks official announcement above third-party reporting, and this is third-party reporting of an intention. It is recorded as a reported plan, and the policy below remains the one in force.

Unanswered by anything read, and load-bearing: how a 30-day retention obligation is satisfied on infrastructure the customer controls while still producing the cross-request detection the policy exists for — that is, what Anthropic receives. Also unstated: whether the option restores the voided ZDR agreements or replaces them with a different contractual object, and whether Fable 5's total lack of ZDR support is affected.

Anthropic — retention required (the policy in force). Since 2026-06-09, prompts and outputs for Mythos-class models (Claude Fable 5, Claude Mythos 5) are retained 30 days for trust and safety, on every surface where the models are offered. It overrides negotiated zero-retention agreements with no opt-out, and Fable 5 does not support ZDR at all. Stated safeguards: no training use, all human access logged, deletion after 30 days "in almost all cases", and human review only through a controlled path after an automated flag. Stated purpose: researching and mitigating jailbreaks — novel attacks, multi-request abuse — and reducing false positives in the safeguard layer (source).

OpenAI — retention claimed unnecessary. On 2026-08-19 OpenAI restated ZDR for eligible API customers (no retention after processing, no personnel review, no training use without opt-in, customer-held encryption keys or customer-controlled infrastructure) and previewed Private Safety Processing: a mechanism that identifies misuse patterns across related interactions and sends OpenAI a narrowly defined safety signal without exposing the underlying prompts or responses. Aleah Houze, Head of Product Policy, gives the rationale — risks at the frontier emerge "when you look over time at multiple interactions", not from a single pair. Enterprise and API only; broader rollout and a technical white paper in September 2026 (source).

What neither has published: any accuracy or false-positive figure for the detection each policy exists to enable. Anthropic states that reducing safeguard false positives is a purpose of retention without giving a rate; OpenAI describes a signal without saying what it contains or how often it fires. This is the third time in two weeks that a safety-relevant classifier has been announced on this wiki with no published error rate — the others being Anthropic's Claude Code auto-mode classifier (89% recall, no false-positive rate) and OpenAI's age-prediction system for ChatGPT for Teens.

Open Problems

1. Can a "narrowly defined safety signal" be derived cross-request without retention? The obvious implementations — hashes, embeddings, running summaries, model-side state — are all derived from content and all persist something. Whether the result still satisfies ZDR as customers understand it is the question the September white paper has to answer, and nothing read answers it now.
2. Is the disagreement about capability or about capacity to build? Anthropic's policy may reflect a judgement that the private technique does not work, or simply that it had not built one by June. No document read states which.
3. What does a customer do about it? Anthropic's requirement is contract-overriding with no opt-out; the option set for a regulated buyer is "accept 30-day retention" or "do not use the model". That is a procurement fact with no published guidance behind it. Partially answered on 2026-08-20 — a third option is reported to be coming, "retain it yourself" — and the answer arrived through Bloomberg rather than through either the policy page or the customer's contract, which is itself the procurement fact.
4. Does customer-held retention actually change the safety question, or only the custody question? If the lab still needs to compute over the content to detect a cross-request pattern, moving the storage moves liability and residency without moving the capability. If it does not, then content retention was never the requirement and OpenAI's position was right in June. Nothing read says which, and it is now the single most consequential unknown on this page.
5. Does saturation cut the other way? Anthropic reported on 2026-08-14 that its task-based evaluations have saturated and no longer register capability gains (source). If pre-deployment evaluation is losing resolution, post-deployment monitoring carries more of the assurance — which strengthens the case for retention and raises the stakes on whether the private alternative works.
6. Nobody has published a comparison. No third party has measured detection quality with content against detection quality with a signal alone, so the central factual dispute between the two labs is currently untested.

Key Papers

• HarmProfile: Characterizing Harmful Distributions in Frontier LLMs (arXiv:2608.14577) — proposes characterising a model by the distribution of its harmful outputs rather than by a pass/fail rate; the instrument class that a retention-backed monitoring corpus makes possible, and the one that survives a saturated threshold.
• No paper read evaluates privacy-preserving cross-request abuse detection for LLM APIs. This is the gap the September white paper would fill, and the reason it is worth reading when it appears.

Related Concepts

• AI Alignment
• AI Governance
• Preparedness Framework
• AI-Enabled Cyberattacks
• Anthropic
• OpenAI
• Claude Fable 5