Date: August 21, 2026
Main source: Anthropic
Link: https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf
Supplementary sources: https://www.reuters.com/business/anthropic-plans-change-enterprise-data-retention-policy-source-says-2026-08-20/
Summary
Anthropic said in its August risk report that it plans to require 30 days of data retention for use of its most capable models, in order to detect sophisticated attacks spread across multiple requests. The company acknowledges the measure may be unpopular with customers used to zero-retention policies. Anthropic says retained data will not be used for training without the customer's explicit approval and that enterprise customers will keep controls over their data. The decision shows a growing conflict between absolute privacy and the ability to detect cumulative abuse.
Why it matters
Data retention can become a contractual differentiator between model providers. Regulated companies, agencies that handle client data and teams deploying agents with access to internal systems will have to review more carefully what information they send to each model and under what policy. Security can no longer be judged only by what a single request does, because an attack can be built across many seemingly harmless interactions.
Practical implications
- Review retention policies before sending sensitive data to any AI provider.
- Keep critical data, secrets and credentials separate from normal agent flows.
- Document which models have access to client information and how long the provider can keep it.