Anthropic Just Broke Their Biggest Promise | Claude Fable 5 Update

The clause under the benchmark

Anthropic shipped Claude Fable 5 today — its most capable public model, and the first in the Mythos class. The benchmarks are the headline. The retention clause is the story.

To use Fable 5, you accept thirty days of data retention on all traffic. Even if you negotiated zero. Anthropic says the new term reaches backward and applies to prior zero-retention agreements too.

What zero retention actually buys

Zero data retention is the deal where the vendor keeps nothing. No copy on disk. Nothing to subpoena. Nothing to leak in their next breach. For hospitals, banks, and law firms, it is often the entire reason they were cleared to use the model at all.

Today that flipped. Nobody got breached. No data leaked. A control that compliance signed off on just quietly stopped being true, and the only signal was a change in the terms.

I’ve spent twenty-five years in cybersecurity watching this exact failure mode. The expensive moment is rarely the breach. It’s the control everyone assumes still holds, long after the ground under it moved.

Capability and exposure ship together

Here’s the detail that should stop you. The model good enough at finding software vulnerabilities that Anthropic blocks it from answering cybersecurity questions is the same model now holding thirty days of your prompts. Capability and retention came in the same box. You don’t get one without the other.

Three questions before anyone in your organization turns Fable 5 on for real work. One. Does our zero-retention agreement still mean anything under these terms? Two. Who in the business is already pasting regulated data into Claude, and on what contract? Three. What’s our move before the new terms become the default everyone is already living under?

The benchmark race gets the coverage. The clause is what lands on the people who own AI risk.