Companies using Fable 5 beware: it’s collecting your data, and there are no exceptions
Every other Claude model available through the API, including Opus 4.8, Sonnet 4.6, and Haiku 4.5, can operate under Zero Data Retention agreements. Fable 5 cannot, and the alarm bells are ringing.
Image by Cybernews.
Every other Claude model available through the API, including Opus 4.8, Sonnet 4.6, and Haiku 4.5, can operate under Zero Data Retention agreements. Fable 5 cannot, and the alarm bells are ringing.
- Anthropic’s Fable 5 mandates 30-day data retention, unlike other Claude models supporting zero retention.
- Existing enterprise ZDR commitments do not cover Fable 5, creating serious compliance concerns.
- Human review access makes Fable 5 risky for legal, regulated, and confidential workflows.
Netizens of the world are already chatting non-stop about Claude Fable, dropped this week by Anthropic. Clearly, the Mythos-class model seems capable of delivering state-of-the-art performance in software engineering and agentic tasks.
Some, though, are advising to look more carefully at what the fine print says about data retention and collection. It’s not looking good.
A significant change
Jun Park, founder and CEO of AI training lab called hillclimb, is pretty straightforward on X: “New policy from Anthropic: if you use Fable/Mythos, they collect your data. No exceptions. Not even for enterprise partners.”
Indeed, Anthropic explains on its Claude Support page: “To ensure we’re responsibly deploying Mythos-class models, we are requiring limited data retention and review as part of our safety work. Prompts submitted to, and outputs generated by, Mythos-class models are retained for 30 days for trust and safety purposes, on every platform where these models are offered.”
This might not sound too bad at first glance. After all, Anthropic says it won’t use this data to train new Claude models, or “for any non-safety-related purpose.”
But on her Medium blog, Jessica Eaves Mathews, a lawyer specializing in AI, explains that, actually, the change is pretty significant.
That’s because while every other Claude model available through the API, including Opus 4.8, Sonnet 4.6, and Haiku 4.5, can operate under Zero Data Retention (ZDR) agreements, Fable 5 cannot.
Check if your data has been leaked
“If your organization previously had a ZDR agreement with Anthropic, that agreement does not apply to Fable 5 traffic. This is a policy change that overrides existing enterprise commitments for this specific model class,” says Eaves Mathews.
No ZDR equals third-party disclosure
Needless to say, ZDR agreements are very important to enterprise customers, who operate under the understanding that their data won’t be stored at all.
But Anthropic says: “This change applies to organizations that have set up workspaces with zero data retention in Claude Console, use Claude Code with ZDR in Claude Enterprise, or access Claude through AWS Bedrock, Google Cloud Agent Platform, or Microsoft Foundry with ZDR.”
When Amazon announced that Claude Fable 5 was now available on AWS, a crucial detail, tucked into the infrastructure section, mentioned: “Once you opt in data retention, your data will leave AWS’s data and security boundary.”
“That’s not a model feature – that’s an enterprise architecture constraint. For a lot of companies, that sentence alone disqualifies Fable 5 from touching certain workloads, no matter how good the model is,” a publication called AI Engineering Collective points out.
For law firms using AI for efficiency, it’s extremely troublesome, Eaves Mathews adds. According to her, even though Anthropic says that the retained data won’t be used to train new models, its employees will have access to it.
“They have built what they call ‘controls’ around that access: scoped viewers, no export, tamper-proof logs, a small number of approved reviewers. But the access exists,” says Mathews.
A model that can sustain long coding tasks may be useful in one organization and risky in another if it touches the wrong repository, secret, or deployment pipeline.
“Anthropic is telling you, in writing, that humans at the company may review the content you run through this model.”
If a human Anthropic employee can review a flagged conversation that contains privileged client communications, that’s third-party disclosure. And this can be seen as a serious breach of confidentiality.
This, of course, applies to other industries as well. A model that can sustain long coding tasks may be useful in one organization and risky in another if it touches the wrong repository, secret, or deployment pipeline.
“For enterprises handling sensitive customer data, legal documents, financial workflows, healthcare records, private source code, confidential M&A material, or regulated infrastructure, this is not a small setting,” says Debjit Dey, founder of AI Engineering Collective.
Does Claude Fable 5 collect and store user data?
Yes. Anthropic says prompts submitted to, and outputs generated by, Mythos-class models such as Fable 5 are retained for 30 days for trust and safety purposes. Unlike other Claude API models, Fable 5 does not support Zero Data Retention (ZDR).
Can enterprises use Fable 5 with Zero Data Retention?
No. Anthropic’s policy says existing ZDR agreements do not apply to Fable 5 traffic. This includes Claude Console workspaces with ZDR, Claude Enterprise setups, and access through AWS Bedrock, Google Cloud Agent Platform, or Microsoft Foundry when ZDR would normally apply.
Why is Fable 5 a security and privacy concern for companies?
Because sensitive prompts and outputs may be retained for 30 days and can be reviewed for safety purposes. For companies handling private source code, financial workflows, legal documents, healthcare records, M&A material, or regulated infrastructure, that creates confidentiality and compliance risks that may rule out the model for certain workloads.
Can Anthropic employees see data sent to Fable 5?
Anthropic says it has controls such as scoped viewers, no export, tamper-proof logs, and a limited number of approved reviewers. But the policy still means human review may occur, which is a major concern for organizations that must avoid third-party disclosure of confidential material.
Unlock more exclusive Cybernews content on YouTube.