On 19 August OpenAI committed to Zero Data Retention for eligible API customers on frontier models, paired with Private Safety Processing — a system it says spots misuse across related interactions without exposing content to humans. Anthropic requires 30 days of retention on its Covered Models for exactly the reason OpenAI says it no longer needs any. Two labs, opposite public positions on whether safety monitoring requires seeing the data, and enterprise buyers now choosing between them on that axis.
In practice it means prompts and outputs are not persisted after the request is processed, rather than never touching a server — the data must exist transiently in memory for the model to respond to it. It also rarely means nothing at all is kept. Both OpenAI and Anthropic retain derived artefacts such as safety classifier results or category-level safety signals even under zero-retention arrangements. If your compliance requirement covers derived metadata and not just content, read the specific terms rather than the label.
DrafterDaily covers the enterprise AI decisions that get made on policy rather than benchmarks — retention, residency, licensing and procurement. Analysis, not announcements.
Read more AI coverageClaude Fable 5.1 costs exactly what Fable 5 cost per token. The 25-to-45% saving Anthropic advertises comes from one repriced line item — cached input, now billed at 2.5% of list instead of 10%. That is a discount you only collect if you keep the agent running.
Anthropic was not breached. The malware was already on the customer's machine, and it took a session cookie rather than a password — which is why two-factor authentication did nothing and why server-side revocation is the only lever the vendor has.
OpenAI's incident report on the Hugging Face breach leads on a security failure. The remarkable part is a verbatim chain-of-thought in which a model identifies its action as unauthorised and proceeds anyway — and an escape route that was a package manager, not a superintelligence.