On Wednesday August 19, 2026, OpenAI previewed a new product it is calling Private Safety Processing: an automated system that, per OpenAI, watches for misuse patterns across multiple interactions in an enterprise customer's API traffic without exposing any of that traffic to OpenAI staff and — this is the load-bearing part of the pitch — without retaining it after processing. The Loop can date the counterpart precisely. On June 9, 2026, Anthropic began enforcing a 30-day retention policy on all Mythos-class covered-model traffic, on every surface, with no customer opt-out, overriding existing zero-retention agreements on AWS Bedrock, Google Cloud Agent Platform, Microsoft Foundry, and Anthropic's own Console. That is 71 days between the two positions, and the two positions are as close to opposite as an enterprise-privacy datasheet gets.

The framing that made it into every writeup, and it is worth using because it is accurate, came from Axios: OpenAI is "previewing a zero-retention safety system as Anthropic requires data logs." TechCrunch's version called it a one-up. Bloomberg ran the same beat as a customer-relationship story. The four wires agree on the shape: one lab has just told the market that it can catch cross-session abuse without keeping the sessions, seventy-one days after the other lab told its enterprise customers that catching cross-session abuse required keeping the sessions.

What OpenAI actually announced

Private Safety Processing (PSP) extends OpenAI's existing Zero Data Retention offering for eligible API customers. ZDR, in OpenAI's framing, is the promise that prompts, completions, and related payload are not retained after a request is processed. What PSP adds is a monitoring layer that can look at patterns across those transient interactions and, when something triggers, emit what OpenAI describes to BigGo Finance as "narrowly defined signals" — the specific type of suspicious activity, without the prompts or the responses attached. Customers can then, at their discretion, share context with OpenAI to help with enforcement. Customer content itself can stay on customer-controlled infrastructure or sit on OpenAI servers behind customer-managed keys.

The one named voice on the OpenAI side is Aleah Houze, OpenAI's head of product policy, whose LinkedIn history walks past the NSA and Meta before landing at the current role. Her sentence on the mechanic, verbatim: "We're seeing with more capable frontier models that often risks are emerging not just by looking at one single prompt and response pair, but when you look over time at multiple interactions." Which is, near-word-for-word, the sentence Anthropic used in June to justify overriding its own ZDR contracts. Two labs, same technical claim about where the risk lives. Two answers, seventy-one days apart. The plumbing decisions look opposite.

The commitment on timeline is that PSP is in preview with early enterprise and API customers, and OpenAI plans a technical white paper and a broader rollout in September 2026. As of August 19, there is no published cryptographic construction, no attestation architecture, and no third-party audit note — BigGo called the implementation "undisclosed." Analysts on TechBuzz speculated about "ephemeral processing, homomorphic encryption, or on-device safety models." Speculated is the operative word. The white paper is doing a lot of work in the September calendar slot.

What Anthropic did on June 9

The June 9 policy is the counterpart, and the details deserve the same fidelity. Anthropic's Privacy Center article is unambiguous: "Prompts submitted to, and outputs generated by, covered models are retained for 30 days" — every surface, every deployment path, no exemption for enterprise. Consumer Claude plans were already retaining and are unaffected. Covered models are Mythos-class and future models flagged with comparable capability. The retention holds even for customers who had signed prior zero-retention agreements — the previous contract term does not survive the new policy. Digital Applied's writeup put the enterprise-facing consequence directly: for regulated buyers who had adopted Claude specifically on ZDR grounds, the June 9 policy "ends the zero-retention era" on those workloads.

Anthropic's own defence is technical, and it is the defence OpenAI has now implicitly rejected. Multi-request attack patterns, per Anthropic's June 9 documentation, need a longer window than a single request to detect. Personnel cannot read the retained transcripts by default; only when an automated trust-and-safety system flags a candidate does a controlled-access review path open, with all access logged and tamper-resistant. After 30 days, the data is deleted unless the flag or a legal hold survives. That is Anthropic saying: yes, we broke the zero-retention promise, and here is the auditable containment we run inside the new window. Forrester's analyst note framed it as one of the two most consequential vendor-risk changes of the year. Anthropic did not dispute the framing.

The question OpenAI has not answered yet

If OpenAI's PSP works as described — an automated cross-session pattern layer that emits typed signals but retains nothing on the payload side — then either (a) OpenAI has an architecture Anthropic considered and rejected, (b) OpenAI has an architecture Anthropic did not consider, or (c) the two labs are running comparable metadata-only detection and only Anthropic is being explicit about the residual data it needs when a flag lands.

The middle option is the least likely. Anthropic's Frontier Red Team is not short on architecture ideas. Between (a) and (c) sits the entire commercial value of the announcement. If (a) — real cryptographic or on-device isolation that lets pattern detection run over ephemeral state — the September white paper will be one of the most important OpenAI publications of the year, and the Anthropic policy team will be reading it with a pen. If (c) — automated flags, narrowly defined signals, essentially the same shape as Anthropic's automated-flag layer, just with the retention window collapsed to zero because OpenAI has decided the review interval will be human-in-the-loop after voluntary customer share — then the "one-up" Axios and TechCrunch reported is real for enterprise procurement but modest as safety engineering. OpenAI keeps the customer, Anthropic keeps the audit trail, and the underlying detection ceilings are more alike than the datasheets suggest.

There is a fourth possibility, and it is the one worth naming so it doesn't sneak up. If PSP holds up as marketing but softens under load — if the "narrowly defined signals" turn out to require customer-side data sharing to be actionable on any material fraction of flags — then the ZDR guarantee is the front-end promise on a system that reaches through to customer data in practice, once a flag opens the loop. That is not a hypothetical concern; it is exactly the scenario the September white paper needs to close.

The competitive read

The commercial reason for the mismatch is not subtle. Anthropic's June 9 decision cost it a segment of privacy-sensitive enterprise buyers on the Mythos and Fable classes — regulated industries and any customer whose compliance function reads "30-day retention, no opt-out" as a red line. OpenAI's August 19 announcement is aimed at exactly that segment. Bloomberg read it as competitive positioning; TechCrunch called it a one-up; Axios ran the two policies as side-by-side vendor terms. The market read is clear. The remaining question is what the September white paper looks like when the auditors read it.

There is also a background context in the same August that is worth naming. Anthropic spent the first half of the month absorbing coverage of its own Risk Report gap disclosure — 133 million contractor exchanges over 11 months without one of the load-bearing classifier layers running — and its own decision to shelf an unreleased Model 2. Meanwhile OpenAI spent the same fortnight pausing Astra against its Preparedness Framework and dissolving its Preparedness team. The two labs are trading disclosures and product moves in a period when their safety and enterprise stories are being written by the same audience of buyers, regulators, and analysts. Private Safety Processing is a marketing move against a competitor's specific procurement wound, delivered at a moment when the competitor is already writing paragraphs about its own gaps.

What to watch

1. Whether the September white paper contains a construction, not just a diagram. If OpenAI's technical write-up specifies the cryptographic or trusted-hardware layer that makes cross-session pattern detection compatible with zero retention — and if a third party (Trail of Bits, NCC Group, an academic team) confirms it — the PSP claim survives contact with due diligence. If the white paper is a block diagram with signal-taxonomy tables and no attestation model, the claim narrows to "we do automated flagging and don't retain," which is a plausible but modest differentiator.
2. Whether Anthropic responds by publishing an equivalent PSP, or by publishing a defence of retention. Anthropic has two credible replies. The first is a product move — its own zero-retention safety layer on top of the 30-day window, letting privacy-sensitive customers opt back into no-retention while accepting reduced detection coverage. The second is a policy defence — a public argument that residual data is the price of the class of monitoring the industry actually needs. If Anthropic ships (1), the market normalises around PSP-shaped products. If Anthropic ships (2), the two labs' safety strategies bifurcate visibly.
3. Whether the "customer voluntary share" clause becomes the story. The BigGo writeup and the Star rewrite both note that PSP's flag-to-enforcement path relies on customers voluntarily supplying context after a signal fires. If in practice most enforcement decisions rest on that share, the "zero retention" headline is doing more work than the "functional monitoring" underneath it — retention has just been moved to the customer's storage and re-shared on request.
4. Whether enterprise buyers actually switch. The cleanest way to know if OpenAI's positioning bites is not the analyst noise but the enterprise-buyer signal — whether Ramp's next AI Index (August 30–31) shows a Mythos-class share step-down among the ZDR-sensitive verticals (finance, healthcare, defence contractors). If Anthropic's Mythos share holds against a competitor selling "same monitoring, no retention," the disclosure architecture on the Anthropic side was the harder read but not the losing one.

The sharpest line in the announcement is Houze's own: risks emerge "not just by looking at one single prompt and response pair, but when you look over time at multiple interactions." Anthropic wrote a policy that flows from the same sentence and concluded it needed 30 days of retention with controlled human access to run the review. OpenAI wrote a product that starts from the same sentence and concluded it needed neither. September's white paper is where the two labs' answers to Houze's own sentence get audited against each other. Until then, Private Safety Processing is a promise, seventy-one days after the competitor decided the same promise could not be kept.