AWS Bedrock to require sharing data with Anthropic for Mythos and future models
Posted by TomAnthony 4 hours ago
> For Fable 5, Mythos 5, and future models on Bedrock with similar or higher capability levels, Anthropic will require 30-day retention for all traffic on Mythos-class models. Retaining data for a limited period allows Anthropic to detect patterns of misuse that are not visible from a single exchange. Once you opt into data retention, your data will leave AWS’s data and security boundary.
From the announcement here: https://aws.amazon.com/blogs/aws/anthropic-claude-fable-5-on-aws-mythos-class-capabilities-with-built-in-safeguards-now-available/
> After 30 days, the data is deleted automatically, except in the rare cases where it's part of a safety investigation or we're legally required to keep it.
From: https://support.claude.com/en/articles/15425996-data-retention-practices-for-mythos-class-models
Comments
Comment by dsign 59 minutes ago
Comment by JeremyNT 33 seconds ago
They're glad to all say their models are too dangerous for the public, so they can nerf the GA versions while allowing only their preferred megacorp or nation state partners access to the real versions.
We can hope the Chinese open weight models will catch up, but if/when they really reach parity with proprietary frontier models you can bet they'll stop releasing their weights too. They don't release this stuff out of the kindness of their hearts.
It's tough to imagine what might possibly derail this.
Comment by miohtama 57 minutes ago
https://www.theguardian.com/world/2026/feb/23/openai-tumber-...
Comment by pczy 26 minutes ago
Note that Anthropic has committed not to train models on logged data, so I don’t understand some of the concerns here. What exactly is your threat model? That Anthropic would train models contrary to their terms of service? That you trust them enough not to log your data prior to this, but not enough to trust their stated limits on how logged data will be used now?
Edit: I am partially convinced by some of the replies. However, it is worth noting that this change primarily affects Enterprise users. Data from consumer plans is already retained for 30 days. Source: https://privacy.claude.com/en/articles/10023548-how-long-do-...
Comment by zmmmmm 16 minutes ago
It doesn't really matter how much you happen trust another party. In the regulatory world it only matters what contracts they will sign that guarantee their compliance. We do have those with AWS, we don't with Anthropic. If Anthropic physically captures the data, they just moved themselves outside the boundary of parties who we can do business with. Unless they want to sign a contract and implement all the corresponding compliance measures. They are insane if they think that's a good deal for them to do all that right now in every jurisdiction where AWS operates, when AWS has already spent a decade building it up.
Comment by kevincox 19 minutes ago
You may also have data management requirements such as allowed storage and transit countries as well as various certifications and contracts that you now need to extend to the second data processor.
Basically if you are already using AWS just adding the AWS-only bedrock model is legally easy and doesn't really change your security posture. If you need to now also log your data to Anthropic it makes the choice much more complicated.
Comment by _jab 18 minutes ago
There's a parallel between data retention and general mass surveillance. Sure, both systems can be used for purely benign purposes, with appropriate safeguards in place. But history shows that surveillance systems are alarmingly easy to co-opt for nefarious means, and model providers do have a heck of an incentive to leverage retained data for internal means.
This is worth protesting, even if I believe this policy itself does not immediately compromise my privacy.
Comment by HarHarVeryFunny 18 minutes ago
Given Anthropic's failure to secure their own source code, do you really trust them to secure yours?
Comment by zsoltkacsandi 18 minutes ago
Comment by OtherShrezzing 2 hours ago
Comment by cobolcomesback 37 minutes ago
Ever since the Mythos announcement it’s been clear that we’re heading towards a future where SOTA models are no longer available to the average person, and not only cost more, but also require payment in the form of use case verification and data sharing. OpenAI’s 5.5-Cyber model requires the same, so it’s not just Anthropic.
We’re unhappy with this because we’ve all gotten used to being able to play with the new shiny model as soon as it’s available, but what I’m seeing in this thread about Anthropic being “stupid” is emotion-based wishful thinking.
Comment by calgoo 4 minutes ago
Comment by iterateoften 16 minutes ago
Cool. Everybody is doing it. Doesn’t make it right or make it good for the people. Everyone should complain and help others wake up that Anthropic isn’t the “good guys” like their narrative in Feb/march led so many to believe.
Comment by cobolcomesback 3 minutes ago
Your straw man isn’t helpful here.
Comment by jeremyjh 40 minutes ago
Comment by calgoo 3 minutes ago
Comment by UqWBcuFx6NV4r 2 hours ago
Comment by disgruntledphd2 58 minutes ago
In theory, definitely.
But this seems like a really, really, really no-good seriously bad decision from Anthropic. Like, I get why they want this (and can see it from their perspective), but many of their largest clients literally cannot allow this without regulator sign-off, which almost certainly won't be forthcoming.
Like, if the Fed and the ECB say this is OK then it might work, but other than that I predict that this decision will be reversed ~soon.
Comment by Aurornis 2 minutes ago
Their largest clients can negotiate their own deals with their own terms.
They do not have to go through the same public Amazon Bedrock deal that you and I sign up for.
Comment by brookst 25 minutes ago
As long as it’s service telemetry, not used for model training, not inspected by humans, not analyzed except for service purposes… I don’t see the regulatory issue.
Are there any regulations covering what telemetry your service providers can keep? I’m skeptical, but even if so it would be trivial for Anthropic to exempt certain larger customers while still keeping the policy published as universal.
Comment by disgruntledphd2 2 minutes ago
By definition lots of the use of AI in these companies is gonna require personal data/PII etc (particularly in KYC/compliance or general processing usecases) which means that there's a regulatory constraint.
I personally would've thought that said organisations and regulators would be massively opposed to this for privacy and risk reasons, which is why I think this won't happen.
Even the companies with less sensitive data are generally paranoid about service providers getting "their" (actually their customers) data.
> Are there any regulations covering what telemetry your service providers can keep?
In the EU, this should be proportionate and should avoid special categories of personal data (which FIs will have a lot of).
Comment by chatmasta 1 hour ago
Comment by realusername 1 hour ago
Comment by flir 1 hour ago
Comment by chatmasta 47 minutes ago
Comment by calgoo 28 seconds ago
Comment by embedding-shape 1 hour ago
Sure, but considering the average person and how short-term their thinking tends to be, I'm not sure I'd jump straight into "think about how much money they could lose, of course they think long-term".
Comment by lijok 2 hours ago
Comment by j-bos 2 hours ago
Comment by embedding-shape 1 hour ago
Comment by wqaatwt 1 hour ago
Large corporations like Microslop, Google, Meta etc. were frequently behave like headless chickens
Comment by panny 55 minutes ago
Comment by ReptileMan 1 hour ago
Comment by cyanydeez 2 hours ago
Comment by RA_Fisher 1 hour ago
Comment by fc417fc802 1 hour ago
Comment by ImPostingOnHN 17 minutes ago
Comment by pitched 2 hours ago
Comment by voxic11 1 hour ago
> For OpenAI GPT-5.4 and GPT-5.5, classifier-flagged traffic will be retained for up to 30 days for automated offline abuse detection
https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-d...
Comment by easton 1 hour ago
Comment by justinclift 48 minutes ago
https://www.anthropic.com/news/claude-fable-5-mythos-5#a-new...
---
## A new data retention policy
Finally, we’re making a change to the way we handle business
customer data for Fable 5, Mythos 5, and future models with
similar or higher capability levels. We will require 30-day
retention for all traffic on Mythos-class models, on both
first- and third-party surfaces. [...]Comment by voxic11 14 minutes ago
Comment by scottmcmac 1 hour ago
Comment by disgruntledphd2 56 minutes ago
I am willing to bet that the SpaceX deal is probably why Fable's launching now, as they are much less compute constrained than they were a month ago.
Comment by irthomasthomas 1 hour ago
Comment by ChrisLTD 53 minutes ago
Comment by brookst 20 minutes ago
Comment by BoorishBears 37 minutes ago
gpt-5.5 isn't larger than gpt-5.4 but costs double.
Comment by storus 58 minutes ago
Comment by thisisauserid 40 minutes ago
Comment by rohansood15 4 hours ago
Comment by baq 3 hours ago
that's obvious, but perhaps worth stating: it's worth it, demand for the model is unprecedented and the only downside for Anthropic if AWS rejected would be some revenue pushed a quarter away as they get Fable ready on their recently acquired compute from xAI and Google.
Comment by whynotmaybe 1 hour ago
Anthropic is trying, well see if it's a bold strategy.
1. https://github.blog/changelog/2026-06-09-claude-fable-5-is-g...
Comment by jreynar 47 minutes ago
Comment by jstummbillig 37 minutes ago
Comment by thefounder 1 hour ago
Comment by avereveard 6 minutes ago
Comment by stuaxo 2 hours ago
I've worked on a few apps for UKGov and I would absolutely be raising this as a massive red flag.
Comment by ttemae 1 hour ago
Comment by htrp 2 hours ago
Comment by 1313ed01 3 hours ago
"For more on how Anthropic handles this data, see Anthropic’s commercial terms and data retention policy. Enabling the Claude Fable 5 policy constitutes acknowledgement of this requirement. Leaving it off keeps Claude Fable 5 unavailable to your organization."
https://github.blog/changelog/2026-06-09-claude-fable-5-is-g...
Comment by xnx 2 hours ago
Comment by lima 2 hours ago
I don't think it mentions sharing the data with third parties such as Anthropic?
Comment by Sayrus 1 hour ago
From https://support.claude.com/en/articles/15425996-data-retenti...
Comment by walthamstow 1 hour ago
Comment by cobolcomesback 1 hour ago
edit: Google’s own docs also say zero data retention isn’t possible with Fable and your data will be retained for 60 days “outside of your account”. I’m doubtful that this data sharing is an AWS-only thing.
Comment by Sayrus 9 minutes ago
Comment by officialchicken 4 hours ago
Comment by gdiamos 56 minutes ago
I expect them to train on their traffic, and I train on mine.
Comment by rozumbrada 3 hours ago
Comment by cherryteastain 45 minutes ago
Comment by _bobm 1 hour ago
Comment by zmmmmm 2 hours ago
Comment by pitched 2 hours ago
Comment by afavour 1 hour ago
https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-d...
Comment by rohansood15 46 minutes ago
Comment by disgruntledphd2 55 minutes ago
Comment by _pdp_ 3 hours ago
Comment by jstummbillig 3 hours ago
Comment by UqWBcuFx6NV4r 1 hour ago
Comment by lima 2 hours ago
Comment by dhruvrrp 2 hours ago
Their carve-outs for safety (public interest) and legal are also valid exceptions in gdpr as well.
Comment by LunaSea 25 minutes ago
Since Anthropic is a US company the GDPR compliance claims would be dubious and open to litigation by entities like NOYB.
Comment by Vespasian 1 hour ago
Everybody should just assume that they are lying about data retention and learning anyway.
They showed zero respect for intellectual property in the past and they will show zero respect now or in the future. A few thousand Euros/dollars in subscription doesn't matter when several trillions are in play (at least in their plans).
Comment by baq 1 hour ago
Comment by BoorishBears 41 minutes ago
60 days.
Comment by shevy-java 3 hours ago
> After 30 days, the data is deleted automatically
Do we believe that?
> or we're legally required to keep it.
Aha - so, data is forever.
Comment by toasty228 3 hours ago
If you don't believe them now why would you have believed them earlier when they said "no data is retained" ?
Comment by adithyaharish 3 hours ago
Comment by romanovcode 3 hours ago
So basically all your data will flow to NSA/CIA/Mossad if they show even slight interest in your org or you as a person. Gotcha.
Comment by baq 1 hour ago
Comment by razieloren 3 hours ago
Comment by dwedge 1 hour ago
Comment by drcongo 3 hours ago
Comment by themafia 4 hours ago
Comment by wewewedxfgdf 2 hours ago
Well, that's the final frontier anyway.
Comment by skeledrew 56 minutes ago
Comment by Hamuko 3 hours ago
Comment by TZubiri 3 hours ago
Even in the happy case where nothing bad happens, you get a badly integrated product, because you integrate not against the actual vendor, but against a abstraction layer that commoditizes the actual product, effectively forcing you to either use the least common denominator of features, or circumventing the actual aggregation model itself with some kind of 'vendor_specific_parameters' parameter in the aggregator API.
My thesis is drop the vendor neutrality, and build your integration with the vendor directly.
Comment by malephex 1 hour ago
Comment by GHanku 1 hour ago
Comment by dhavd 2 hours ago
Comment by codeduck 3 hours ago
Comment by lufiya01 25 minutes ago
Comment by gauravvij137 58 minutes ago
Comment by lufiya01 24 minutes ago
Comment by chattermate 3 hours ago
Comment by Torikul007 4 hours ago
Comment by cboyardee 2 hours ago
Comment by jedisct1 2 hours ago
Comment by tybit 2 hours ago
Comment by fc417fc802 54 minutes ago
Also broadly available to us plebs via openrouter and similar. Claude is available on there under ZDR terms via the Google Vertex and Amazon Bedrock providers.
Comment by wewewedxfgdf 2 hours ago
It is literally 10X to 20-X cheaper to directly buy Anthropic subscriptions for your devs.
Comment by pridkett 1 hour ago
And for the cost, if you’re an enterprise with more than 150 people, you’re on the token plan.
Comment by weberer 1 hour ago
Comment by fp64 1 hour ago
Comment by wewewedxfgdf 48 minutes ago
Comment by Qhemlomo 2 hours ago
We 'trust' Amazon already and Amazon has no incentive at all to collect the data to finetune claude because they don't own claude.
Comment by kgwgk 1 hour ago
Comment by Qhemlomo 1 hour ago
I only told a commentor why a business would pay more to Amazon than going directly to Anthropic.
The announcement itself is def problematic and either leads to big companies accepting this and then going directly to anthropic or some talks in the background we don't know yet what it will entail.
Comment by kgwgk 1 hour ago
Comment by pitched 2 hours ago
Comment by sheeshkebab 1 hour ago
Comment by wewewedxfgdf 46 minutes ago
Comment by htrp 2 hours ago
Comment by UqWBcuFx6NV4r 2 hours ago
Comment by wyynoapp 1 hour ago