Anthropic’s controversial data retention for Fable 5 and Mythos 5
Follow Us
One of Anthropic’s main differentiators when it came to enterprise clients was its policy of zero data retention. All you had to do was sign up and set up your workspace, and once you received the response from the API, everything you entered as a prompt disappeared. It was one of the best ways for Anthropic to differentiate itself from its competitors, who still struggled to get their privacy policy right. The launch of Fable 5 and Mythos 5 broke this promise by Anthropic.
SurveyAlso read: Fable 5 restored: Your guide to what Anthropic’s flagship AI can and can’t do
Both of these models fall into the category of Covered Models for which zero retention option doesn’t even exist. Everything gets saved for 30 days regardless of any prior negotiations on that topic that were made a long time ago and regardless of whether you use the model in Bedrock, Google Cloud, or Microsoft Foundry.
The logic behind Anthropic’s reasoning is pretty simple. It requires the retention period to capture any novel types of attacks and jailbreak attempts that real-time classification cannot detect and will be done through human review that involves only selected people who use software tools preventing any exports or downloads of that data. All accesses to the system are logged. The information is not used for any training for future models. After 30 days, it is deleted automatically.
Not unless there is another provision mentioned in the very same policy. The second clause allows Anthropic to keep the data for up to two years if content is flagged for policy violations. This is no footnote, this is the actual upper limit. Thirty days is the lower limit for general traffic, not the upper limit for all of the data collected by these systems.
Also read: WhatsApp vs Indian govt: A brief history of disagreements
This is where I feel that the whole narrative becomes fuzzy on purpose. Anthropic has made its reputation on being extremely careful and safety-oriented. And yet it decided to use the smaller number as its opening statement.
The actions by Microsoft are a valuable datapoint, but certainly not all there is to know about the issue. After just two days of being available for sale, Fable 5 was taken off the list for internal use inside the organization via the same GitHub Copilot platform. This is not about a company rejecting Anthropic’s capacity; it is about making sure that the standards of zero retention cannot be implemented alongside Anthropic’s new policy. And since even Microsoft, with all the leverage it can exert, is not ready to sign off on the internal implementation of Fable 5, you may get an idea of how the terms of the fine print sound to those who conduct real due diligence.
To my mind, this was a trade-off that had to happen the minute Anthropic decided to release such a capable model to the public. There is no way to say that a certain model requires guardrails against novel attacks and that no one is going to check what people are sending to it. These two things contradict each other.
What bothers me is less the trade off itself and more how it was communicated. A policy this significant, one that overrides existing contracts, deserved sharper framing than a support article that leads with the reassuring number and tucks the two year exception several paragraphs down. Enterprises deploying Fable 5 or Mythos 5 right now are making a call on incomplete information, and Anthropic knows it.
Also read: OpenAI halves their inference cost but no one knows how
