Anthropic has launched Enterprise Frontier Safeguards (EFS), a new architecture designed to satisfy the conflicting demands of regulated teams requiring zero data retention and security teams needing cross-session misuse detection.
The system stores monitoring data in cloud infrastructure controlled by the customer rather than Anthropic’s servers. Detection logic remains with Anthropic, while custody, encryption keys, and the authority for human review stay with the client. Access is currently request-based, with a target for broad availability later this fall. Eligible customers can currently run Claude Fable 5 and Fable 5.1 under zero data retention rules.
The technical problem EFS is solving
Anthropic states that data retention is necessary for detection quality, not for training models. The company introduced a 30-day retention window with Fable 5 and maintains that it has never trained on enterprise data without explicit permission.
The argument for holding data is specific. Sophisticated misuse often spreads across multiple tasks, sessions, and accounts, sometimes involving stolen or misappropriated enterprise credentials. An automated classifier that processes each interaction and discards it instantly cannot catch this pattern. Correlation requires a time window. Anthropic has documented this pattern in its own work disrupting AI espionage.
Regulated customers understood the security logic but could not adopt it because they refused to hand over data. Consequently, Anthropic moved the retention window rather than removing it entirely.
What EFS actually changes
Anthropic built EFS with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail, and the public sector. Contributors included the Analysis and Resilience Center for Systemic Risk, whose membership includes CISOs at Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo, plus teams at Comcast, KPMG, Mastercard, Salesforce, and Visa. Anthropic says the design conversations covered a quarter of the Fortune 100 and every US global systemically important bank.
Three design decisions emerged from that process:
- Storage moves to the customer: Activity data used for monitoring can live in the customer’s own cloud account, under their encryption keys, access policies, and audit logging. Enterprises told Anthropic that onboarding another trusted data vendor triggers customer notifications and contract updates, so the architecture avoids creating one.
- Review moves to the customer: When monitoring detects a pattern worth attention, the signal goes directly to the customer. Anthropic’s position is that automated review handles the scan; a person still adds value confirming real misuse and clearing false positives, and in regulated environments that person must be cleared for privileged legal material, non-public information, or drug-safety reports. EFS runs automated safety monitoring with no Anthropic human review required.
- Detection stays with Anthropic: Automated systems analyze a rolling window of traffic for serious misuse, specifically attempts to build offensive cyber or biological capability and signs of stolen or leaked credentials.
Where this sits in the model roadmap
EFS is one of three enterprise concessions shipped alongside Claude Fable 5.1 and Mythos 5.1. The other two concessions are pricing and precision. Fable 5.1 cut cache reads by 75% to $0.25 per million tokens, which works out to roughly 25% lower cost on typical workloads and up to about 45% on highly agentic ones. Its cybersecurity safeguards now produce around 60% fewer interventions per Claude Code session than Fable 5’s, partly because Fable 5.1 is permitted to identify software vulnerabilities without developing exploits for them.
What it means
For teams making things, the shift allows for a workflow that satisfies security compliance without sacrificing the ability to catch complex, cross-session threats. Instead of managing separate contracts for storage and detection, the architecture consolidates the burden of data custody with the client while keeping the detection engine where it is most effective. This removes the friction that previously prevented regulated industries from adopting advanced AI agents.
