It is actually worse than that. It is at least 30 days. There is an "almost" that is doing a ton of heavy lifting here "deletion after 30 days in almost all cases". My read of that is they can hang onto data for as long as they want, even if they usually won't. And "all traffic" with an agentic harness is basically your entire codebase you work on.
> We will require 30-day retention for all traffic on Mythos-class models, on both first- and third-party surfaces. We won’t use this data to train new Claude models, or for any non-safety-related purpose, and we’ve instituted new privacy protections including logging all human access to the data and ensuring its deletion after 30 days in almost all cases (see this post for further details). The data will help us defend against complex and novel attacks (including new jailbreaks and attacks that operate across many requests) as well as help us identify and reduce false positives.
A startup that uses agentic coding tools such as Claude Code or Codex is packaging up their entire codebase and sending it directly to their LM provider. Depending on their product, they might be sending it directly to a potential competitor.
Odd times we are living in!
people over-rate how much software/IP is useful in running a successful business. There are genuinely very few IP in this world that needs to be protected. Everyone else is running stupid CRUD apps
They also over index fear of LargeCo stealing IP from SmallCo. In fact, LargeCo is typically more scared about even the possibility of any product team looking at competitor internals due to lawsuits.
I’d be more scared of a data leak due to LargeCo being hacked than I would about LargeCo prying into the data.
What I don’t trust LargeCo with is personal information. I’ve heard too many horror stories about Govs and LargeCos swapping customer nudes or stalking ex’s to be comfortable with anything personal on those systems. But that’s a whole different topic.
LargeCo is probably struggling under the weight of technical debt and organizational challenges/politics.
I bet if you gave them the Codebase of the Gods, it’d be a heap of hacks inside a couple months.
You could not be more wrong in the aggregate.
Literally how LLMs will continue to learn to code and easily replace whatever you build with them.
Incredible that you could so blithely misunderstand this
> people over-rate how much software/IP is useful in running a successful business
Indeed, by a couple trillions...
How can you make such bold and generic claims without some data backing it?
actuaries look for data. visionaries take leaps in faith. There was no data proving LLMs will work at scale. Google waited for the Data. OpenAI and then Anthropic took the leap of faith. The result is there for all to see. The core attribute of a successful AI Researcher was were they AGI-pilled and not were they waiting for data for unknown unknowns?
Trust and liability are the actual currency in a software business.
Your email domain is significantly more important than whatever is in your corporate GitHub repositories.
Yes, it certainly is an odd situation when some people believe you cannot use Mythos-class models because security while others believe you must do code reviews with Mythos-class models because security.
and all their keys, because sooner or later, the harness is gonna read them
One company's irrational fear is a competitive advantage for someone else.
Not just “a startup”! Also, famously, Meta, with their famous AI usage dashboards
And by Fable they really mean Opus 4.8, because every mundane workflow or chat I try to use it in will eventually drop to Opus.
Pretty incredible just how much good will Anthropic managed to burn.
Fortunately I can't use Fable anyway, since their hyperactive content flaggers do not let you work on anything remotely biological or medical related (i.e. parse a CSV with some medical content, nope, you're probably a bioterrorist) and you get downgraded to Opus immediately.
I'm not even working on anything biological/medical, almost all PyTorch work is getting flagged (not even a safety notice and a downgrade, just an outright refusal with "this is against our ToS").
My 2 cents is that doctors people with lots of money and very specific needs who generally don't really go for tech jobs, so they're probably planning to create a separate monetization tier.
That, or alternatively, Mythos is so good at medical stuff, that it cam replace a lot of physician work 90% of the time, pissing off doctors, while the remaining 10% would result in very expensive lawsuits.
> That, or alternatively, Mythos is so good at medical stuff, that it cam replace a lot of physician work 90% of the time, pissing off doctors
Well they definitely don’t give a teaspoon of shit about putting people out of work by hawking munged-up versions of those people’s data, which was involuntarily ‘ingested’ for the benefit of society (in a way that happened to fuel a centabillion dollar industry.) So it’s prolly not that one.
Yes! I have hit the same brick wall. What sort of idiots are doing this? Honestly, I have no idea. And just before their IPO. SO far Anthropic marketing has been perfect and spotless. This is serious slipup.
It's temporary. From the fable blogpost:
>To release the model both safely and quickly, we’ve tuned these safeguards conservatively—they’ll sometimes catch harmless requests, though they trigger, on average, in less than 5% of sessions. With more capable models arriving in the coming months, we’re working to improve our safeguards and reduce false positives as quickly as we can.
It's good they're being overcautious here. The alternative is far worse.
The alternative of... saving lives?
They don't want the real risk of someone using it to make biological or genetically targeted weapons, and they don't want the social risk of someone asking it a bunch of leading questions in order to 'prove' some racist thesis or to 'prove' Mythos is woke if it declines to along with their performative inquiry.
Let's face it, if some rando comes up to and asks if you have a few minutes to talk about population biology there's a good chance they're a kook.
Will someone think of the children
Related ongoing thread:
AWS Bedrock to require sharing data with Anthropic for Mythos and future models - https://news.ycombinator.com/item?id=48473166 - June 2026 (223 comments)
Google Cloud also makes you accept this safety addendum to deploy Fable 5 via their Model Garden https://cloud.google.com/terms/advanced-ai-safety-addendum
Yeah I'm never using either one, and if that becomes standard Anthropic will never see a dime from me again. I'm going to draw the line in the sand right there.
So if you are under an NDA, does this violate it?
I guess the better question would be if you are under and NDA and using an online model, are you already violating it but does this violate it further?
In the same way that using Gmail and Dropbox and iCloud and Notion violates it. (Which IANAL but for most NDAs would be not at all.)
I never had an NDA permit such usage.
Your NDAs prohibit emailing a colleague about the e.g. project, or discussing it in a Slack DM with the client, or tracking progress on it in JIRA? You have to do NDA’d work exclusively with local tools or end-to-end encryption? Those are some difficult NDAs!
I’m pretty sure (even just based on the revenue of various SaaS products) that’s not typical, hence “most NDAs”. I’m also sure some require a SCIF, but that’s not most of them.
the real risk is using it at all as you are already sending them your data. If you are ok with that, then this retention/review seems ok.
There were two (expensive) exceptions / alternatives so far: Bedrock and Vertex. Their Zero Data Retention was in fact contractually enforced. Now it is all f...d because of these morons at Anthropic. For now I am better off just using DS via their API.
This is just a tragic moment for Tech. We just killed AI privacy. OpenAI already follows this trend and others will do too.
The only hope now is ... tada .. Mistral LOL
Hmmm no? The only way is to deploy your own local model, using anyone else's you are at their whim on what happens to your data.
It’s not binary. With AWS previously you have contractual guarantees with a third party, that’s been in business for a couple decades, which explicitly state zero seconds of data retention - only as long as needed for inference.
Consider the security angle too. You now have to rely on Anthropic’s infrastructure security. You did not previously when you used Bedrock/Vertex/etc.
From a personal use perspective yes, the big issue here is enterprise and existing contracts as surely most companies will have signed zero retention.
I mean not just the part 30 days data retention but I think the serious trade of this product is just the token efficiency. They trade it for precision. The claims that they make that it found a 30 year software bug from millions of lines of code is just precision. To human it's looks like a lot but for it it's just the ablity to process (token processing). Let's see how long it runs. Peace.
Then don’t use it.
That’s exactly what my employer had communicated. It will not be allowed.
Step 1: Find all companies which refuses/bans to use SOTA models from irrational fear.
Step 2: Use SOTA models to copy them and crush them
Step 3: Profit.
(Yes, not every business is easily replicable, but you sure can find some)
This. And AI labs seem to be above IP / Copyright law and absolutely nothing will happen to them when they grab all the data and package it up.
Can you name a single example of a business that has been replaced by another business leveraging LLMs to copy and "crush" their software?
Pretty much any Chinese business. (Except takeouts and laundries)
Step 4, get sued because you violated an NDA or other regulation?
I'm not talking about Claude copying.
I'm talking about scouring Twitter/LinkedIn and look at posts from employees who say SOTA model is banned. Look at what the business do. Copy it using SOTA. Call their clients with 30% discount and faster turnaround and higher quality product.
It is complicated, but I can get Private Equity of even VCs to fund this idea.
tl;dr -- I'm actually agreeing with you. Anthropic will never copy your business model due to NDA. But there are plenty of fearmongering about they copying you and because of which you won't use their models. If their models are genuinely SOTA you can use that information to your advantage and crush scaredy-cats.
Edit: The fact that these get downvoted is exactly the reason why it's easy to win
I mean, this is the biggest reason that's my employer's position
What an annoying company, I wish it didn't exist..
[flagged]
[dead]
I actually think that’s warranted. And if you used it to poke around, you would also agree.
> And if you used it to poke around, you would also agree.
Would you elaborate? Not sure what you're describing
All I can say to my team (and my clients): "f...k Anthropic". They've just put both Bedrock and Vertex on slippery slope of "we don't collect your prompts. period. ... comma ... except ..."
Right now we have changed the code of all our agents to data retention mode 'none' (Note: not "default" or "inherited", this is not enough now!) and we are fighting with GCP doco to set similar things for Vertex.
This is just terrible.
How were they not already auditing access to customer data?
They were not keeping it beyond the timeframe necessary for the model to process it, so there wasn't access there to audit.
Half of my customers will drop them right away, and the other half, after I explain to them what this means.
It's only for this model, not the one you're already using. And they're not training on the data. It's supposedly to detect abuse etc (such as someone retrying repeatedly with different variations to get around their protections)
You must have very unrepresentative customers. What will they use?
[dead]
Even worse when you git push something Microsoft gets all your code!
Yes, that is your intended purpose of “git push”, it’s to save. And only if you use GitHub.
A better analogy here is probably “every time you use VS Code, the files you edit get sent to Microsoft”.
Some legitimate concerns:
• You have trade secrets. Previously; you can use services like Bedrock, etc, with signed contracts and significant reputations. Your contract is between AWS and you, and stays within your AWS security boundary.
• Security breaches. Remember when Anthropic accidentally published the source tree of Claude code? Or Meta’s recent AI recovery bot that didn’t check if the supplied recovery email was actually the email of the Instagram account? The best way to reduce your exposure is to minimise storage.
• Weaponised T&S. For example what if Anthropic decided to build a classifier for “usage in unsupported regions” that’s super overbearing (as we see with Fable) and vacuums up all context/input/output if there’s Mandarin? Contractually they could now retain it forever, not just 30 days, for ‘trust and safety purposes’ and perhaps have AI scan for any new or interesting ML techniques at scale, for Anthropic’s own use? They say just can’t train Claude models on the data.
All analogies are bad.
Only if you push it to GitHub.
That is why, for the last five years I have been checking in with them, code with some of the most atrocious quality. So far...its working....
Thank you for your service.
The system works!