Anthropic moved the evidence, not the detector

What was announced

Anthropic developed the offering with more than 100 customers across financial services, healthcare, manufacturing, telecoms, law, retail and the public sector, and with cloud partners at AWS, Google Cloud and Microsoft Azure. It rolls out in phases starting later this autumn, and it carries no charge — which is itself a signal about what kind of thing it is.

The contradiction this actually solves

Zero data retention is the control that unlocked regulated buyers, and it was always a blunt one: the vendor does not keep the exchange. Anthropic's own framing of the problem is the clearest statement of why that hurt. Sophisticated misuse does not fit inside a single exchange — it spreads across multiple sessions and accounts, so analysing each interaction on its own and discarding the data immediately makes correlation over time impossible.

That is not a policy preference, it is arithmetic. A classifier that sees one message cannot distinguish a security researcher's question from the fourteenth step of a patient campaign, because the discriminating signal is the sequence. ZDR customers were therefore buying confidentiality and paying for it in detection quality, and almost nobody priced that trade explicitly, because the cost was invisible by construction.

The interesting move is which half Anthropic chose to relocate. It would have been simpler to build a smaller, weaker single-turn detector and call the problem solved. Instead the storage moved and the analysis did not, which keeps detection quality intact and changes the custody of the evidence. Every consequence below follows from that one choice.

Moving the evidence moves the duty

Under vendor-side monitoring, an enterprise's position on serious misuse by its own staff was comfortable and rarely articulated: the vendor watched, the vendor decided what crossed a line, and if nothing was reported, nothing had to be actioned. ZDR made that even simpler by removing the watching. Neither arrangement required the customer to maintain an opinion.

EFS ends both. Alerts route to you and human review is yours by default, so the sentence "we were not aware" stops being available in the one place it used to be automatic. This is not a criticism of the design — it is the correct allocation, since the employer is the party that can actually act — but it is a change in obligation that will land on organisations who read the announcement as a privacy improvement and nothing else.

And the store itself is an artefact with a life of its own. A bucket of your employees' prompts, in your account, under your retention policy, is discoverable in litigation, in scope for a subject access request, and subject to legal hold. Before EFS that object did not exist for a ZDR customer. Deciding how long it lives is now a decision someone in your organisation has to make, and the default — whatever the bucket's lifecycle rule happens to be — is not a decision, it is an accident.

The scope is narrow. The corpus is not.

What the automated systems look for is stated and it is deliberately narrow: serious misuse, specifically attempts to build offensive cyber or biological capability, and signs of stolen or leaked credentials. That is a frontier-safety scope. It is not an employee-monitoring product, and Anthropic is not offering to tell you which of your engineers is pasting customer data into a prompt.

But the data being retained to support that narrow detection is broad by necessity — a rolling window of traffic is a rolling window of everything. So the gap between what is flagged and what is recorded is now yours to manage, and it points in two directions at once. The sanctioned-and-inbound insider pattern, where an authorised employee asks one question and an agent performs four thousand individually-permitted reads, is out of scope for this classifier and fully present in the corpus. If you ever want to detect it, the evidence is finally in a place you can query. If you never intend to, you are still storing it.

Both of those are legitimate positions. Neither is the default, and the default is what you get if this rolls out as an infrastructure change with no one from legal in the room.

This alert queue is not a SOC queue

The reflex is to route the alerts to the security operations centre, and it is the wrong reflex for a structural reason. A SOC's playbooks key on unauthorised access: an identity that should not be here, a system that should not be reachable, a credential used from an impossible location. The triage question is "was this permitted?", and the answer drives everything downstream.

An EFS alert is about authorised use by an authenticated employee inside their normal permissions. Nothing was violated, so a SOC analyst working their standard flow will find no policy breach and close it. The alerts that matter here need a different reviewer, a different question — "should this have happened, given who they are and what they were working on?" — and a path that leads to HR, legal and a named executive rather than to containment.

Two constraints on that reviewer are worth settling early. In the EU, reading the verbatim prompt text of identified employees is employee monitoring, and in codetermination jurisdictions that is a works-council matter before it is a tooling matter. And the reviewer needs standing access to a store you have just made highly sensitive — so the access model for the bucket deserves the same scrutiny as the access model for production.

What you hold, and what you still do not

You now hold the corpus. You do not hold the classifier, and that asymmetry is the honest limit of the design. You cannot tune the false-positive rate, you cannot measure recall against your own traffic, and when an alert leads to an employment consequence you cannot explain to a works council, a tribunal or the employee how the determination was made, beyond that a vendor's model flagged it.

That is not a reason to decline the offering — vendor-side monitoring gave you strictly less, and ZDR gave you no cross-session detection at all. It is a reason to write the appeal path before the first alert, and to treat a flag as the start of a human investigation rather than a finding. Any process that lets an unauditable classifier's output become an adverse decision without an independent human step will fail the first time it is challenged.

It is also worth noting what the price tells you. EFS carries no charge, and free is what you call a thing that is a condition of the sale rather than a product: it is how Anthropic keeps safety monitoring intact while selling into accounts that require zero retention. That alignment is genuine, and it is also why the offering is shaped around Anthropic's obligations first and your insider-risk programme second.

Settle these before the phased rollout reaches you

Further reading

On this wiki:

• Insider misuse of agents — the sanctioned-and-inbound pattern this corpus would evidence and this classifier will not flag.
• Redacting PII from agent traces — the same custody question for the traces you generate yourself.
• Retention and legal hold — what the new bucket needs before it fills up.
• Detecting agent compromise — the detection side, with your own signals.
• Serious incident reporting — where an alert you now own has to go next.
• Data residency and sovereignty — why ZDR mattered to these buyers in the first place.

Sources:

• Developing Enterprise Frontier Safeguards with our customers — Anthropic, 1 September 2026
• Anthropic's Enterprise Frontier Safeguards lets your Claude logs stay in your cloud — Help Net Security
• Anthropic introduces zero-retention AI safety monitoring for enterprises — CSO Online