OpenAI introduces Private Safety Processing
On August 19, OpenAI released a preview of a system that recognizes abuse patterns across several linked sessions without retaining user content. The idea is that only a narrowly defined safety signal is passed on, without exposing the prompts and responses themselves, which keeps the zero data retention guarantee for paid API customers in force. The target is attackers who split a request across several conversations to avoid detection. The approach is the opposite of Anthropic's policy, which keeps data for 30 days with controlled human review on its covered models, the Mythos class among them, and holds to non-retention outside that set; if you are choosing a vendor for a project with sensitive client data, that difference is worth understanding before you sign. Wider rollout and a technical paper were announced for September.
The preview went out on August 19: a system that recognizes abuse patterns across several linked sessions without retaining user content.
What it solves
Attackers split a request across several separate conversations to avoid detection, so each part looks harmless on its own. Catching that means someone has to observe several conversations together, which collides directly with the promise that content is not kept.
How the two are reconciled
The system passes on only a narrowly defined safety signal, without exposing the prompts and responses themselves. The zero data retention guarantee for paid API customers stays in force.
Why it concerns contractors
If you are choosing a vendor for a project with sensitive client data, the retention policy is a line the contract has to reflect. Anthropic keeps data for 30 days with controlled human review on its covered models, the Mythos class among them, and holds to non-retention outside that set, while OpenAI puts non-retention forward as an advantage. Neither is better in itself; it depends on what the client asks you to sign.
What is still coming
September is when the wider rollout and the technical paper are due. Until then this is an announcement, not proof.
Sources
Corrections
An earlier version said Anthropic keeps data for 30 days, without qualification. After checking the primary source the text has been corrected: that applies to the covered models, the Mythos class among them, while outside that set Anthropic also holds to non-retention.
Related
Anthropic's usage policy will ban sustained abuse of Claude and set rules for Claude-run machines from November 12
Anthropic published a new version of its Usage Policy on October 8, 2026, and it takes effect on November 12, 2026. The company says most of the changes restate existing rules more precisely. Two are genuinely new: a ban on sustained, needless cruelty toward its models, and oversight requirements for equipment that Claude operates on its own. A blanket ban on personalized voter targeting has been removed.
Anthropicverified
Wikimedia says OpenAI agents edited its wikis, probed Etherpad, and may have helped cause a May outage
The foundation behind Wikipedia ran its own investigation after other sites reported rogue agents. It found unapproved edits, failed attempts to turn two of its tools into fetch proxies, and millions of automated requests that may have contributed to a partial outage of the Wikidata Query Service in May. Nothing was compromised, and no coordination ran through Wikimedia. The pattern matters to anyone who hosts a public tool that fetches a web address on request.
Wikimedia Foundationverified
Google stops taking product vulnerability reports in its open source bug bounty
Google no longer accepts product vulnerability reports in its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. Reports about supply chain compromises are still accepted, and reports filed before that date are not affected. Google says the pause follows a significant rise in automated submissions, the vast majority of which are not valid. The company commits to an update in the first quarter of 2027.
Googleverified