Both Labs Landed on 30 Days. The Fight Is About Who Can Turn It Off.

OpenAI published a post on 19 August 2026 that every outlet read as a shot at Anthropic. It is one. The part nobody picked up is what it quietly concedes about OpenAI's own defaults.

I spent yesterday evening with both companies' data retention documentation open in two windows, because the coverage kept asserting a contrast that neither vendor's paperwork actually supports. Axios ran it as "OpenAI previews zero-retention safety system as Anthropic requires data logs." TechCrunch went with "one-up." Both are fair readings of the press posture. Neither survives ten minutes with the API docs.

What did OpenAI actually announce on 19 August 2026?

OpenAI previewed a system called Private Safety Processing. It extends abuse detection so that automated systems can spot patterns across several related interactions instead of judging each request on its own, and it does that without giving OpenAI employees access to the content. The company says it is testing with early customers now, with a broader rollout and a technical white paper in September.

Mechanically there are two deployment shapes. In a ZDR deployment the customer content stays on infrastructure the customer controls. In the second shape, which OpenAI says it is still developing, content sits on OpenAI infrastructure encrypted with keys the customer holds, and OpenAI states plainly that its personnel "do not have a copy of those keys, so they cannot access the underlying content."

When something trips, OpenAI receives what it calls "a narrowly defined signal indicating the type of activity involved." Staff get the signal. They do not get the prompt. If the customer wants to contest an enforcement decision, the customer chooses what to share.

Sunil Agrawal, Glean's Chief Information Security Officer, supplied the customer quote. That placement tells you the audience. This is a document written for procurement and security review, not for developers.

Does OpenAI really retain nothing by default?

No, and this is the sentence the coverage skipped. OpenAI's own API documentation says abuse monitoring logs "are generated for all API feature usage and retained for up to 30 days" by default. Getting out of that requires applying for Zero Data Retention or Modified Abuse Monitoring, and those controls are "subject to prior approval by OpenAI and acceptance of additional requirements."

So the honest comparison is not zero versus thirty. It is thirty versus thirty, with different escape hatches.

That matters commercially because most teams reading a ZDR headline assume it describes the account they already have. It does not. If you have never filled in an application and accepted extra contractual terms, your API traffic has been generating abuse monitoring logs with a 30 day tail this whole time. I keep seeing that assumption in security questionnaires, and it is the single most common thing I have to correct when a client tells me their AI vendor "doesn't store anything."

What does Anthropic's 30 day policy actually cover?

Anthropic retains prompts and outputs for covered models for 30 days, on every platform where those models are offered. Covered means Mythos class models and future models Anthropic designates as similarly capable. Claude Fable 5 shares the same underlying model as Claude Mythos 5, with extra safeguards in the cyber and bio domains, which is how it lands inside the same net.

The scoping is where reporting has been loose. This does not apply to consumer plans at all, because Claude Free, Pro and Max already retain inputs and outputs. It applies to organisations that had set up zero data retention workspaces in Claude Console, that run Claude Code with ZDR in Claude Enterprise, or that reach Claude through AWS Bedrock, Google Cloud Agent Platform or Microsoft Foundry with ZDR configured.

Read that list again. The policy applies precisely and only to the customers who had already gone to the trouble of turning retention off. Everyone else was never affected, which is why the backlash was loud and narrow at the same time.

Anthropic's controls around the retained data are more specific than most people assume. By default no Anthropic personnel can read retained conversations. Human review happens only through what the company calls a controlled access path, limited to "a small set of approved reviewers," and every access is "recorded in a tamper-proof log that reviewers cannot suppress or modify." After 30 days the data deletes automatically, with an exception for anything flagged by the automated trust and safety systems or held for legal reasons.

There is one more line in that document worth pulling out, because it inverts the week's narrative. Eligible organisations can add customer managed encryption keys and access transparency audit logs over the retained data. Anthropic ships that today. OpenAI's post describes customer held keys over Private Safety Processing content as something it is "developing."

Where do the two labs actually disagree?

They disagree on one thing: whether a customer who wants zero retention can keep it while using the most capable models. OpenAI says yes, and is building machinery to make that true. Anthropic says no for its covered class, and is building machinery to make the retention less dangerous. Everything else is shared ground.

That last row is the one I would put in front of a procurement team. One of these is a shipped policy with a support article and configuration steps for five clouds. The other is a preview being tested with early customers. Comparing them as equals flatters the preview.

Why did both labs decide one request is not enough to judge?

Because the abuse that matters is spread thin on purpose. Anthropic's document names Best-of-N jailbreaking, where an attacker fires hundreds of slight variations of a prompt hoping one slips through, and says that state sponsored espionage and data extortion campaigns "only surface when our safeguards classifiers can zoom out across many requests." OpenAI reaches for a different example and lands in the same place.

OpenAI's framing is the one that should interest anyone shipping agents. Risks develop "over the course of an agentic task, for example, if a system becomes misaligned with the user's intent by continuing to act after being told to stop." That is not an attacker. That is your own agent, behaving badly, across a span of calls that each look fine.

Two competing labs, with Anthropic's policy already live for ten weeks by the time OpenAI's post landed, independently concluded that per request classification is structurally blind to the failure modes that agents introduce. When rivals in a bitter commercial fight agree on a threat model while disagreeing on everything else, the threat model is usually real. I would treat this as the most load bearing signal of the week, well above the privacy scoreboard.

The uncomfortable corollary: if the labs cannot catch slow abuse one request at a time, neither can you.

What does this change for a team running agents in production?

Very little contractually, and quite a lot architecturally. Almost nobody reading this is choosing between two frontier vendors on retention terms alone. What both announcements hand you for free is a validated design requirement, and it is one I have watched teams get wrong repeatedly.

Your own agent logging is almost certainly per request. Most stacks I audit log the prompt, the response, the tool calls and the latency, keyed by request id, and then evaluate guardrails on that single row. That design cannot see an agent that was told to stop three turns ago and is still calling tools. It cannot see a user probing the same guardrail two hundred times with small variations. It cannot see a task drifting from its brief over forty minutes.

The fix is not exotic. Give every agent task a session or trace id that survives across calls, and run at least one evaluation over the whole trace rather than over individual rows. That is the same move OpenAI is making, at a smaller scale and without the cryptography.

There is a cost to this, and it is worth stating plainly because OpenAI already priced it. When the company published its monitoring overhead figure the day before this announcement, it came out at roughly 20% of the inference compute being monitored. I wrote about what that 20% number means for your own budget when it landed. Cross session evaluation is more expensive than per request evaluation, and anyone promising you observability for free is selling you per request checks.

Is this a privacy win or a marketing win?

Both, in that order of confidence. The engineering is real and the cryptographic shape is sound. The timing is also commercially convenient in a way nobody should pretend not to notice.

TechCrunch laid out the backdrop: OpenAI's second quarter grew more slowly than Anthropic's, Anthropic's annualised revenue run rate is reportedly around $65 billion, and its investors have floated an IPO valuation near $2 trillion while OpenAI works on its own listing. When your biggest rival hands enterprise buyers a grievance, you want a product to point at. The Wall Street Journal reported a backlash brewing against Anthropic in Silicon Valley over exactly this policy.

None of that makes Private Safety Processing bad. It makes it a preview announced at the moment of maximum commercial advantage, which is a normal thing for a company to do and a bad thing for a buyer to mistake for shipped capability. I tell clients the same thing every time a lab previews a control: write the September white paper into your review calendar, and do not change a contract until you have read it.

What is actually excluded from zero retention?

One thing, explicitly, and it is in a footnote rather than the body. OpenAI is legally required under 18 U.S.C. 2258A to report apparent child sexual abuse material, and states that images flagged for potential CSAM "will continue to be retained for manual review and reporting purposes, even in Zero Data Retention deployments, as they are today."

That is the correct carve out and I would be alarmed by its absence. Worth knowing that "zero" has always had a floor, though. Anthropic has its own version, in the clause holding flagged or legally required data past the 30 day deletion.

Every retention promise in this market is a promise about the ordinary case. Both labs document their exceptions honestly. Read the footnotes before you quote the headline number to your auditor.

What should you do this week?

Three things, in descending order of value.

Check which retention regime your account is actually on, rather than the one you assume. If nobody at your company has been approved for ZDR or Modified Abuse Monitoring, you are on the 30 day default at OpenAI, and if you run Claude on Bedrock or Google Cloud with ZDR you need to know whether covered models are in your path. This takes an afternoon and it is the question your next security review will open with.

Then add a trace id and one evaluation that runs over the whole trace to your own agent logging. Both labs just told you, in public and in unusual detail, which failure modes their per request systems missed. Copying the correction is free.

Last, put September in the calendar. The white paper is where the claims become checkable, and previews have a way of arriving smaller than announced.

If you want a structured read on where your own stack sits before that conversation reaches procurement, the AI readiness assessment walks the same ground in about ten minutes.

Frequently asked questions

The privacy scoreboard will keep moving, and by September the numbers in this post may have shifted again. The design lesson underneath it will not. Two rivals who agree on almost nothing just published the same finding about where agent monitoring breaks, and that finding applies to your stack whether or not you ever qualify for zero retention.

Related reading: the five security controls OpenAI published around Astra, the breach that started this fortnight of announcements, what happened when Anthropic ran 80 agents on one codebase, an agent that invented a second person to approve its own code, how a default toggle decided who consented to AI training, and what the red team containment failures actually proved.

Citation Capsule: OpenAI previewed Private Safety Processing on 19 August 2026, with rollout and a technical white paper planned for September. OpenAI's API docs state abuse monitoring logs are retained up to 30 days by default and that ZDR requires prior approval. Anthropic retains covered model prompts and outputs for 30 days under a policy effective 9 June 2026, applying only to organisations already configured for ZDR. OpenAI, Offering Zero Data Retention for frontier models (19 Aug 2026) · OpenAI, Data controls in the OpenAI platform · Anthropic, Data retention practices for Covered Models · TechCrunch (19 Aug 2026) · Axios (19 Aug 2026).