Anthropic Requires 30-Day Data Retention for Fable and Mythos Models

Anthropic has begun requiring limited data retention and review for its most capable models. Under a policy effective June 9, 2026, prompts submitted to and outputs generated by covered models are retained for 30 days to support the company's safety work, on every platform where those models are offered.

Which models and which customers

The rule covers Mythos-class models and future models with similar capabilities that Anthropic designates as covered. Claude Fable 5 and Fable 5.1 share the same underlying model as Claude Mythos 5 and Mythos 5.1 but ship with additional safeguards, particularly in the cyber and bio domains. Other models stay under their current terms.

Consumer plans — Claude Free, Pro and Max on web, desktop and mobile, including Claude.ai and Claude Code — see no change, because inputs and outputs are already retained on those surfaces. The update targets organizations with zero data retention (ZDR) workspaces in Claude Console, Claude Code with ZDR in Claude Enterprise, or Claude reached through AWS Bedrock, Google Cloud's Agent Platform or Microsoft Foundry with ZDR. Some of those customers will be told they are eligible to use Fable with ZDR.

Why retention is required

Anthropic says Mythos-class models represent a substantial increase in capability, some of which can serve benign and malicious ends alike. Certain attacks only become visible across multiple requests: best-of-N jailbreaking sends hundreds of slight variations of a prompt hoping one will work, while state-sponsored espionage and data extortion campaigns surface only when classifiers can look across many requests instead of one at a time. Detecting those patterns requires keeping prompts and outputs temporarily so they can be analyzed together.

How the data is protected

By default, no Anthropic personnel can read retained conversations. Human review happens only through a controlled access path — for instance when automated trust and safety systems flag content — and only by a small set of approved reviewers. Every access is recorded in a tamper-proof log that reviewers cannot suppress or modify, and data is deleted automatically after 30 days except in rare flagged cases or where the law requires otherwise. Eligible organizations can add customer-managed encryption keys and access transparency audit logs.

What administrators must configure

For the Claude API used directly, retention is turned on per workspace in the developer console under Workspace, Manage, Privacy Controls; other ZDR workspaces keep their setting. Claude Platform on AWS works the same way, with retained data handled by Anthropic under the same controls. On Amazon Bedrock and Google Cloud's Agent Platform retention must be enabled and data stays in AWS or GCP; in Azure Foundry it is configured per subscription, so a ZDR customer needs a separate one. Claude Code follows the workspace or cloud environment it runs in, and Claude Enterprise administrators with ZDR gain admin-console controls to change the setting or set up a separate sandbox organization.