According to reports, Anthropic released its first Mythos-class AI model, Claude Fable 5, yesterday, sparking concerns within Microsoft. Several insiders revealed that Microsoft has restricted employees’ internal use of Claude Fable 5 due to Anthropic’s newly introduced data retention policy. Although Microsoft quickly rolled out Claude Fable 5 to customer-facing service platforms such as GitHub Copilot and Foundry, this model does not appear in the model selector used by the internal version of GitHub Copilot deployed at Microsoft. Currently, other Claude models remain fully functional internally because they adhere to the “zero-data-retention” (ZDR) rule. Microsoft reportedly informed staff that its legal team is evaluating changes to Anthropic’s data retention policy. The primary concern centers on the security of client data and confidential information. As of now, it remains unclear whether Microsoft’s legal department will approve the internal use of Claude Fable 5. It was reported that Claude Fable 5 requires Anthropic to retain user prompts and outputs to operate its newly launched safety classification system. This means all conversation logs will be deleted after 30 days. However, if the system determines that certain prompts or outputs violate Anthropic’s usage policies, these records may be retained for up to two years. This policy change has raised serious compliance concerns among Microsoft’s legal team. Microsoft declined to comment on requests for remark regarding this matter. Claude Fable 5 marks the broad release of Anthropic’s Mythos series of AI models. Just weeks ago, Anthropic publicly stated that capabilities demonstrated by this series in cybersecurity tasks were so powerful that they posed risks too great for public release. To ensure the safety of Claude Fable 5, Anthropic implemented prompt protection mechanisms—the direct reason behind this shift in data retention policy. This incident highlights the ongoing tension between safety and privacy preservation in the AI industry—as models become more capable, stricter data retention requirements emerge, while enterprise clients increasingly demand greater control over their own data sovereignty.