AI Agents Create A New Zero Data Retention Problem For OpenAI And Anthropic

OpenAI and Anthropic are facing a growing challenge around zero data retention (ZDR) as their AI systems become capable of handling longer, more complex and multi-step tasks. Zero data retention policies are designed to prevent customer prompts and model responses from being stored, an important requirement for enterprises handling sensitive information. But as AI models evolve from answering isolated questions to acting as agents, providers increasingly need broader context to detect misuse and safety risks.

The tension is straightforward: the less data an AI provider retains, the harder it can be to identify patterns that emerge across multiple interactions. At the same time, enterprises in sectors such as finance, healthcare and professional services may be unwilling or unable to let AI providers retain sensitive customer information. OpenAI has now proposed a new approach called Private Safety Processing that attempts to address this problem without giving its employees access to customer content.

What Is Zero Data Retention?

Zero data retention is a data-handling arrangement under which eligible customers can require an AI provider not to retain their prompts and model responses after a request has been processed.

For businesses, this can be particularly important when AI systems process confidential information, proprietary code, financial records, medical information or sensitive customer data.

OpenAI says eligible API customers using ZDR can have their prompts and responses processed without the company retaining them after the request. OpenAI also says business data is not used to train its models by default.

Zero Data Retention At A Glance

Particular	Details
Meaning	Customer interaction data is not retained after processing
Primary users	Enterprise and eligible API customers
Main purpose	Privacy and regulatory compliance
Key benefit	Limits provider access to customer content
Main challenge	Reduces visibility across interactions
Importance	Increasing as AI handles sensitive workflows
OpenAI approach	ZDR plus Private Safety Processing
Anthropic approach	ZDR available for eligible customers

Anthropic also offers zero data retention policies to many customers, while acknowledging that applying ZDR universally can make it harder to detect misuse and learn from real-world system usage.

Why AI Agents Are Making ZDR More Difficult

The problem becomes more complicated as AI systems move beyond simple question-and-answer interactions.

A traditional chatbot might answer a single question and finish the interaction. An AI agent can potentially work through a task involving multiple steps, tools and interactions.

A security problem may therefore not be visible in any single request.

Traditional AI

Prompt
  ↓
Response
  ↓
Task Complete


Agentic AI

Instruction
  ↓
Planning
  ↓
Multiple AI Responses
  ↓
Tool Calls
  ↓
External Systems
  ↓
More Interactions
  ↓
Task Completion

OpenAI says potentially harmful intentions can become visible only when multiple interactions are viewed together. It also points to risks involving repeated attempts to probe safeguards, activity coordinated across accounts and agentic systems that continue acting after being instructed to stop.

The Core ZDR Dilemma

The problem can be summarized as a trade-off between privacy and safety visibility.

If an AI provider retains interaction data, it can potentially analyze patterns across conversations and identify suspicious behavior.

If the provider does not retain the data, it has less information available for cross-interaction safety analysis.

Privacy Vs Safety

Zero Data Retention	More Data Retention
Stronger customer data control	Greater safety visibility
Less provider access	More cross-session analysis
Easier privacy compliance	More information for abuse detection
Lower exposure of sensitive data	Higher data-handling responsibility
Harder to identify long-term patterns	Better pattern detection

Neither side completely solves the problem.

For enterprise customers, privacy may be non-negotiable. For AI providers, however, safety monitoring becomes increasingly important as models become more capable.

OpenAI Proposes Private Safety Processing

OpenAI has introduced Private Safety Processing, currently described as a preview, as an attempt to solve this problem.

The company says the system is designed to analyze patterns across related interactions while keeping the underlying customer content inaccessible to OpenAI personnel.

The approach is intended to preserve ZDR while allowing automated safety systems to evaluate more than one interaction at a time.

Customer Data
      ↓
Private Processing
      ↓
Automated Safety Systems
      ↓
Pattern Detection
      ↓
Limited Safety Signal
      ↓
OpenAI

The important distinction is that OpenAI says it would receive a narrowly defined safety signal rather than the underlying prompts and responses.

How Private Safety Processing Works

OpenAI says Private Safety Processing can operate whether customer content remains on infrastructure controlled by the customer or is stored using OpenAI infrastructure.

For OpenAI-provided storage, the company says customer content can be encrypted with keys controlled by the customer, with OpenAI personnel not possessing copies of those keys.

OpenAI’s Proposed Architecture

Component	Role
Customer content	Remains protected
Customer-controlled infrastructure	Possible storage location
Encryption	Protects stored content
Automated safety systems	Analyze patterns
OpenAI personnel	Do not access underlying content
Safety signal	Limited information returned to OpenAI
ZDR	Maintained for eligible deployments

OpenAI says it plans to begin rolling out Private Safety Processing and publish a technical white paper in September 2026.

Why Context Matters For AI Safety

A single AI interaction may look harmless even if it forms part of a much larger sequence.

For example, a user could make a series of individually innocuous requests that collectively indicate an attempt to bypass safeguards.

OpenAI says risks can also emerge when agents perform extended tasks and gradually move beyond the user’s intended authority.

Interaction 1
   ↓
Looks Normal
   ↓
Interaction 2
   ↓
Looks Normal
   ↓
Interaction 3
   ↓
Looks Normal
   ↓
Combined Pattern
   ↓
Potentially Suspicious Activity

This is where conventional interaction-by-interaction monitoring can become less effective.

Anthropic Has Identified A Similar Problem

Anthropic has also acknowledged the tension between ZDR and safety monitoring.

In its Frontier Safety Roadmap, the company said it offers ZDR to many customers because it helps protect sensitive information. However, it also said applying zero data retention universally could significantly hamper efforts to detect misuse and learn from real-world usage.

Anthropic completed an internal report in March 2026 examining how its safeguards could be improved by changing data retention policies. The company later said it was undertaking a major project to improve data retention practices for certain future models from a safety perspective.

Anthropic’s Position

ZDR
 ↓
Better Customer Privacy
 ↓
Less Stored Data
 ↓
Less Safety Visibility
 ↓
Harder Cross-Interaction Detection

Anthropic’s own roadmap therefore illustrates that the issue is not unique to OpenAI.

Anthropic Offers ZDR For Eligible Customers

Anthropic says ZDR is available on its Claude Platform API and Claude Code for approved customers.

Its enterprise offerings also include custom data-retention controls, including zero-retention configurations for certain products and workflows.

This gives enterprise customers greater control over how their AI interactions are handled.

OpenAI Vs Anthropic

Feature	OpenAI	Anthropic
ZDR availability	Eligible API customers	Approved customers
Business data training	No by default	Enterprise data not used for training
Enterprise retention controls	Available	Available
Cross-interaction safety challenge	Yes	Yes
New safety approach	Private Safety Processing	Working on future retention practices
Key tension	Privacy vs safety	Privacy vs safety

Both companies therefore face the same fundamental question: how can increasingly capable AI systems be monitored safely without requiring customers to surrender control over sensitive information?

Enterprise AI Makes The Problem More Important

The stakes are particularly high for enterprise customers.

Large organizations can send highly sensitive information to AI systems, including:

• Financial records
• Customer information
• Legal documents
• Proprietary research
• Source code
• Business strategies
• Internal communications

OpenAI specifically highlights financial records, health data, confidential business plans and proprietary research as examples of sensitive information handled by organizations using its systems.

Why Enterprises Want ZDR

Enterprise Concern	Why ZDR Helps
Confidentiality	Limits provider retention
Regulatory requirements	Supports data-control policies
Customer privacy	Reduces exposure
Intellectual property	Protects proprietary information
Security	Reduces stored sensitive content
Compliance	Helps satisfy internal requirements

For many enterprises, the ability to control data retention can determine whether an AI system can be deployed in the first place.

AI Agents Increase The Privacy Stakes

AI agents create another layer of complexity because they can potentially access multiple systems and perform actions on behalf of users.

A conventional chatbot might receive a paragraph of text.

An agent could potentially interact with email, documents, databases, calendars, software repositories and external websites.

The amount and sensitivity of information processed can therefore increase dramatically.

Chatbot
User Prompt
   ↓
AI Response


AI Agent
User Instruction
   ↓
AI Planning
   ↓
Files
   ↓
Databases
   ↓
Software
   ↓
Web Services
   ↓
External Actions

This makes both privacy protection and safety monitoring more important.

Data Retention Is No Longer Just A Storage Question

Historically, data retention policies largely focused on how long a company stores information.

With AI agents, the question is becoming more complicated.

Organizations also need to consider how AI systems use information across multiple interactions, what context they retain, how safety systems access that context and whether the provider can reconstruct activity after an incident.

Modern AI Data Governance

Question	Enterprise Consideration
What is stored?	Prompts, outputs, files and metadata
Where is it stored?	Customer or provider infrastructure
How long is it retained?	Defined by policy
Who can access it?	Employees, systems and subprocessors
Is it used for training?	Contract and policy dependent
Can patterns be detected?	Increasingly important
Can data be deleted?	Must meet policy requirements
Can agents access systems?	Requires additional controls

The rise of agentic AI is therefore expanding the definition of AI data governance.

Security Monitoring Needs To Evolve

Traditional safety systems can examine individual requests for known patterns.

But increasingly capable AI systems can create more complicated risks.

OpenAI says its Private Safety Processing is designed to allow automated systems to identify patterns across related interactions without exposing the underlying customer content to OpenAI employees.

This represents a shift from content retention for monitoring toward privacy-preserving analysis.

Old Approach

Store Content
     ↓
Review / Analyze
     ↓
Detect Risk


Emerging Approach

Protected Content
     ↓
Privacy-Preserving Processing
     ↓
Automated Pattern Detection
     ↓
Limited Risk Signal

If the technology works as intended, it could provide a model for balancing enterprise privacy with AI safety.

The Approach Still Has Technical Challenges

Privacy-preserving safety systems are not necessarily simple to build.

AI providers need to determine how much context is required to detect risks while ensuring that the underlying information remains protected.

They also need to minimize false positives and false negatives.

Key Technical Challenges

Challenge	Risk
Limited visibility	Some threats may be missed
False positives	Legitimate activity may be flagged
Encryption	Can complicate processing
Cross-session analysis	Requires careful privacy controls
Agent behavior	Risks can emerge over long tasks
Metadata	Could itself contain sensitive information
Latency	Additional processing could affect performance

OpenAI has said it will publish a technical white paper detailing its approach, which should provide more information about these trade-offs.

The Issue Could Shape Enterprise AI Adoption

Enterprise customers are increasingly evaluating AI providers not just on model quality but also on privacy, security and compliance.

A company may prefer a slightly less capable AI model if it can guarantee stronger control over sensitive information.

This means data retention policies could become a competitive differentiator.

Enterprise AI Buying Criteria

Factor	Importance
Model capability	High
Reliability	High
Security	Very high
Data retention	Very high
Compliance	Very high
Cost	High
Integration	High
Agent capabilities	Increasing
Safety monitoring	Increasing

OpenAI itself says enterprise AI adoption depends on customer control of data, while its business offerings emphasize encryption, compliance and retention controls.

ZDR Could Become More Important As Models Improve

As models become more capable, they are likely to handle increasingly sensitive and complex tasks.

That creates a paradox.

More capable AI makes enterprise deployment more valuable, but the same capability increases the consequences of privacy and security failures.

More Capable AI
      ↓
More Useful Enterprise Tasks
      ↓
More Sensitive Data
      ↓
Greater Privacy Requirements
      ↓
Stronger Safety Monitoring Needed
      ↓
ZDR Becomes More Difficult

The industry therefore needs solutions that address both sides of the equation.

OpenAI And Anthropic Are Moving Toward Privacy-Preserving Safety

The latest developments suggest that the industry is moving away from treating data retention as a simple yes-or-no choice.

Instead, providers are exploring architectures where AI systems can detect safety signals without exposing raw customer content.

OpenAI’s Private Safety Processing is one example of this direction, while Anthropic’s recent work on future retention practices shows that it is also examining how privacy and safety should interact as models become more powerful.

Emerging Model

Customer Controls Data
          ↓
Encrypted / Protected Content
          ↓
Automated Safety Processing
          ↓
No Human Access To Content
          ↓
Limited Safety Signal
          ↓
Provider Responds To Risk

This could become an important architecture for enterprise AI.

The Bigger Picture

The zero data retention dilemma is becoming more significant as AI systems evolve from conversational tools into agents capable of performing long-running, multi-step tasks. OpenAI says potentially serious risks may only become visible when several interactions are considered together, while Anthropic has similarly acknowledged that universal ZDR can make misuse detection more difficult.

The emerging solution is to separate access to customer content from automated safety analysis. OpenAI’s Private Safety Processing is designed around that principle, with the company saying customer content can remain protected while automated systems identify patterns and send back limited safety signals. Anthropic is also examining how its retention policies should evolve for future models.

Looking Ahead

The future of enterprise AI may depend on whether providers can demonstrate that privacy and safety do not have to be opposing objectives. Enterprises want strong guarantees that confidential information remains under their control, while AI providers need enough visibility to detect sophisticated misuse and ensure increasingly autonomous systems behave within their intended boundaries.

OpenAI’s planned September technical white paper on Private Safety Processing should provide more detail on how its approach works in practice. For Anthropic, its ongoing work on future data-retention practices could provide another model for addressing the same challenge. As AI agents become more capable, the industry will increasingly need privacy-preserving safety systems that can understand patterns across interactions without turning enterprise data into a permanent source of provider visibility