Anthropic EFS: Zero-Data-Retention, Real Misuse Detection

Anthropic EFS: Zero-Data-Retention, Real Misuse Detection

Enterprise AI buyers have been stuck between two things they both need. Regulated teams want a zero data retention (ZDR) guarantee, so no prompt or agent transcript ever sits on a vendor's servers. Security teams need misuse detection, which historically meant the vendor holding that same data long enough to correlate it. Pick one and you lose the other.

This week Anthropic announced Enterprise Frontier Safeguards (EFS), an architecture that tries to give both at once. EFS stores monitoring data in cloud infrastructure the customer controls — not Anthropic's. Detection stays with Anthropic. Custody, keys, and any human review stay with the customer.

Is it deployable today? Not yet. EFS rolls out in phases with broad availability targeted for later this fall, and access is request-based. Until it ships, eligible customers can run Claude Fable 5 and Fable 5.1 under ZDR.

The technical problem EFS is solving

Anthropic's stated reason for retention is detection quality, not training data. The company introduced 30-day data retention starting with Fable 5, and it says plainly it has never trained on enterprise data without explicit permission — and never will.

The argument for holding data is narrow, and worth restating. The most sophisticated misuse Anthropic has observed spreads across many tasks, sessions, and accounts — including cases involving stolen or misappropriated enterprise credentials. If you run an automated classifier on each interaction and discard the result instantly, you cannot catch that shape of attack. Correlation needs a window of time. Anthropic has documented this pattern in its own espionage-disruption work.

Regulated customers understood the security logic and still couldn't adopt it — so Anthropic moved the window rather than removing it.

What EFS actually changes

Anthropic built EFS with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail, and the public sector, together with cloud partners AWS, Google Cloud, and Microsoft Azure. It also worked with the Analysis and Resilience Center for Systemic Risk, whose membership includes CISOs at Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo, plus teams at Comcast, KPMG, Mastercard, Salesforce, and Visa. Anthropic says the design conversations covered a quarter of the Fortune 100 and every US global systemically important bank.

Three design decisions came out of that process:

• Storage moves to the customer. Activity data used for monitoring can live in the customer's own cloud account — Amazon S3, Azure Blob Storage, or Google Cloud Storage — under their encryption keys, access policies, and audit logging. Enterprises told Anthropic that onboarding another "trusted data vendor" triggers customer notifications and contract updates, so the architecture avoids creating one.
• Review moves to the customer. When monitoring flags a pattern worth attention, the signal goes straight to the customer. Anthropic's position is that automated review handles the scan, but a person still adds value confirming real misuse and clearing false positives — and in regulated environments that person must be cleared for privileged legal material, non-public information, or drug-safety reports. EFS runs automated safety monitoring with no Anthropic human review required.
• Detection stays with Anthropic. Automated systems analyze a rolling window of traffic for serious misuse: attempts to build offensive cyber or biological capability, and signs of stolen or leaked credentials.

Each of these is a separate opt-in — customer-owned storage, customer-managed encryption keys, and fully automated review — and none of them change model behavior, API pricing, or rate limits. Anthropic charges nothing for EFS; if you store data in your own bucket, your cloud provider bills you for the storage, reads, writes, and egress the same way it bills any other resource.

Where this sits in the model roadmap

EFS is one of three enterprise concessions shipped alongside Claude Fable 5.1 and Mythos 5.1. The other two are pricing and precision. Fable 5.1 cut cache reads by 75% to $0.25 per million tokens — roughly 25% lower cost on typical workloads and up to about 45% on highly agentic ones. Its cybersecurity safeguards now produce about 60% fewer interventions per Claude Code session than Fable 5's, partly because Fable 5.1 is permitted to identify software vulnerabilities without developing exploits for them.

What this looks like in practice

If you operate a security team that has to ship this kind of control, the shape of the integration is probably familiar. Think of EFS not as a new SaaS you bolt on, but as a storage sink plus a detection contract you wire into your existing SIEM and IR workflow:

Claude traffic (Fable 5.1 + safeguard layer)
        │
        ▼
rolling-window monitor (Anthropic automated detection)
        │  flags a pattern worth attention
        ▼
your S3 / Azure Blob / GCS bucket  (customer keys, audit logging)
        │
        ▼
your security team reviews & clears false positives

The flags land in your bucket. Your people — not Anthropic's — decide what happens next. That is the whole bet: retain the evidence, but under custodianship that passes regulatory muster, so the detection benefit survives the privacy requirement.

Why this matters, and the honest caveat

The Register's take is that this is zero data retention where the customer must check it worked — you are now on the hook for the review chore that Anthropic used to do. There is also a real question of whether relocating retention is the same as eliminating it. Analysts call it "provider-side zero data retention alongside customer-custodied retention" — the retained evidence still exists, just not under Anthropic's roof. And notably, Anthropic avoids claiming 30 days is the exact number the math demands; it only says correlation needs "a meaningful period of time."

For Malaysian tech teams, this is worth watching for a couple of reasons. First, it shows the two big frontier labs converging on the same answer: OpenAI shipped a similar "private safety processing" layer a couple of weeks earlier in the same "don't retain on the provider, detect anyway" spirit. Second, it quietly reframes the rogue-model-containment debate: rather than argue endlessly about who gets to see what, the industry is now building custody models that let a third party observe — jurisdiction-agnostically — without owning the data. For teams mapping the wider agent security posture, EFS is the enterprise-shaped piece of that puzzle.

Key takeaways

• EFS pairs ZDR-equivalent privacy with automated detection that spans sessions and accounts.
• Activity data lands in the customer's own S3, Azure Blob, or Google Cloud Storage bucket.
• Flags route to the customer; no Anthropic human review is required.
• Customer-owned storage, customer-managed keys, and automated review are each opt-in.
• Anthropic charges nothing for EFS; your cloud provider bills the storage and egress.

Sources

• Anthropic: Anthropic announces Enterprise Frontier Safeguards
• CSO Online: OpenAI adds an AI safety layer to detect misuse without retaining enterprise data
• The Register: Anthropic promises zero-data retention, but customers must check it worked
• Anthropic: Disrupting AI espionage
• Anthropic: Claude Fable 5.1 and Claude Mythos 5.1