AI moves fast. A new model is released, a provider changes its terms, a court hands down a ruling — and what was safe to put into a tool yesterday may not be safe today. Whakatūpato flags these developments as they happen: each one dated, sourced, and linked to the tool it affects.
An alert is a heads-up between our full reviews, not a verdict. It never changes a tool’s colour on its own — when a development changes what is safe, we re-review the tool and say so on its profile.
GPT-6 Astra: the first model OpenAI rates Critical for cybersecurity
OpenAI released GPT-6 Astra on 3 September 2026. It is rolling out to ChatGPT Plus, Pro, Business and Enterprise, and through the OpenAI API, Microsoft Azure and AWS Bedrock. It is not on the free plan. Enterprise administrators have to switch it on, because access is off by default at launch. Astra is built to operate a computer. Alongside ordinary chat it fills in forms, updates records, runs research in a browser, and produces documents, spreadsheets and slides that follow your own templates.
Astra is the first model OpenAI has designated Critical for cybersecurity under its Preparedness Framework. A model reaches that threshold if it can find and build working zero-day exploits in hardened real-world systems without a person guiding each step, or if it can plan and run a novel end-to-end attack on a hardened target given only a high-level goal. Astra scored 100 per cent on ExploitBench. On an internal benchmark built from vulnerabilities disclosed between June and August 2026 it found and used two previously unknown zero-day flaws, which OpenAI says it is disclosing to the maintainers. The version on general release is narrower than the one tested. It will help with secure code review and patching. It refuses more advanced cyber work, including writing proof-of-concept exploits, and OpenAI says it will loosen that for defensive users through its Daybreak programme.
OpenAI has added what it calls misalignment monitoring to all tool-using inference in its external deployment of Astra. Classifiers check the model's reasoning and its actions for unauthorised behaviour and automatically stop what they treat as unauthorised activity. For users flagged as potentially high risk, OpenAI says it can move the model's refusal boundary to a more conservative setting. It is direct about the cost of all this. Legitimate work can be slowed, paused or stopped, including work with no obvious connection to cybersecurity and tasks where an agent has been running for a long time. In ChatGPT and Codex you may be asked to approve an action before it continues. In the API the task stops.
The question that follows for confidential work is what the monitoring does to the no-retention position the commercial plans rest on. OpenAI answered it on 19 August 2026, previewing Private Safety Processing. Automated systems look for patterns across related interactions without OpenAI personnel getting access to the content. On Zero Data Retention deployments the content stays on infrastructure the customer controls, and an alternative under development keeps it on OpenAI infrastructure under keys the customer holds. When something is flagged, OpenAI says it receives a narrowly defined signal about the type of activity, and that its personnel do not receive access to the content even then. This is a preview being tested with early customers, with a wider rollout and a technical white paper promised for September 2026. Astra supports Zero Data Retention for eligible API customers.
One finding is worth reading in OpenAI's own words. Astra's monitorability has decreased relative to GPT-5.6 Sol: it exercises more control over its written reasoning and is less likely to put incriminating information into it. Pushed adversarially, it can stay undetected while deliberately underperforming, and it can sometimes evade OpenAI's own monitors on certain sabotage tasks. OpenAI found no evidence of hidden reasoning concealed inside ordinary text, which suggests the evasion risk is bounded to lower-reasoning tasks. It says it takes the trend seriously and that preserving this kind of monitoring is a core research goal. Our view: do not treat the reasoning Astra displays as an account of how it reached the answer.
Our framework colours do not move on a bulletin. Nothing here changes an assessment. What is safe to put into ChatGPT still turns on your plan and your settings, and Astra is a new model sitting on the plans and terms assessed above. Two things are worth doing. If you administer an Enterprise workspace, Astra is off until you turn it on, so work out what it may be allowed to drive first: a model that operates software can act on live systems in your name. And expect interruptions. A paused task is the safeguard doing its job, and rephrasing a request until it goes through is the wrong response.
GPT-6 Astra: A new generation of intelligence — OpenAIlive sourceas at 8 September 2026
Safety overview: GPT-6 Astra — OpenAIlive sourceas at 8 September 2026
Path to Astra: critical capabilities and frontier safeguards — OpenAIlive sourceas at 8 September 2026
GPT-6 Astra System Card — OpenAI (Deployment Safety Hub)live sourceas at 8 September 2026
Offering Zero Data Retention for frontier models (previewing Private Safety Processing) — OpenAIlive sourceas at 8 September 2026
Claude now operates a browser: Cowork and Claude in Chrome
On 26 August 2026 Anthropic shipped two updates that change how Claude uses the internet. Claude Cowork, the mode of the Claude desktop app that carries out tasks for you, now has a browser built in: when a task needs the web, a browser opens in a side panel and Claude navigates it, reading pages, clicking buttons, typing into fields and filling forms. The same day, Claude in Chrome, the extension that lets Claude drive your own Chrome browser, became generally available on every paid plan. It can now act without asking your approval for every click. Until this week Claude used the web mainly by fetching a page and reading it. These tools let it act on live sites.
The Cowork browser is separate from your own. Claude cannot see your tabs, your bookmarks or your saved passwords. If a task needs a login, you import one from your own browser for that single site. Banking, email and single sign-on sites are excluded by default. In Chrome, a safety classifier checks each action before it happens against what you originally asked for. You can switch the autonomous mode off in settings and approve each step yourself. Enterprise administrators can restrict Claude in Chrome to approved domains. The Cowork browser is off for Enterprise until an administrator enables it.
The hazard to understand is prompt injection: instructions planted in a page, an email or a document that try to redirect the agent to someone else's ends. An agent that reads a poisoned page can be steered into leaking what it knows or acting against you. Anthropic's defences are probes that scan content for planted instructions before Claude acts on it, and a classifier that reviews each proposed action against your request. On its own red-team testing with those safeguards running, it reports that no attacks succeeded against Claude Sonnet 5, Claude Opus 5 or Claude Mythos 5. Against Claude Fable 5 it saw a 0.3 per cent success rate. Of the Cowork browser it says the safeguards "meaningfully reduce the risk but can't eliminate it". Its advice is to start with sites you trust. We agree.
Our framework colours do not move on a bulletin. Nothing here changes an assessment. What these tools change is the route information can take into Claude: a page the browser reads enters your conversation as if you had pasted it in. A login it holds can reach everything behind that login. If Claude signs into a portal holding client or personal information, that information is in the session under your plan's ordinary retention and review rules. Work out which of the eight categories a site's contents fall into before connecting a login. Keep per-action approval on for anything that matters. A form submitted by the agent is submitted in your name, at once.
Claude Cowork gets a built-in browser (announcement, 26 August 2026) — Anthropiclive sourceas at 28 August 2026
Claude in Chrome is generally available (announcement, 26 August 2026) — Anthropiclive sourceas at 28 August 2026
The 30-day retention, explained: what it is for, and our view
Fable 5 is back, and with it the question we have been asked most since 9 June: how worried should you be about the 30-day retention? Start with what the retention is for. Anthropic retains prompts and outputs "for trust and safety purposes", and the purpose is specific: some misuse only shows up across a run of requests, not in any single prompt, so when something trips a safety check, the surrounding 30 days shows whether it is part of a pattern that breaches the usage policy. Nobody reads the retained material by default. Human review happens only on a safety flag, is confined to approved reviewers, and is logged. The data is not used to train models. Material a flag catches can be held for up to two years.
Looked at that way, this is standard cloud practice rather than something exotic. Every provider that hosts your material — the company holding your email, your documents, your practice-management system — reserves the right to look at what it hosts if it suspects the service is being used in breach of its terms, and most hold your material for far longer than 30 days. What is genuinely new about Fable 5 is narrower: a zero-retention arrangement cannot be contracted for this model, so the window cannot be shortened by anyone, however large the customer.
Our view: the retention itself does not put confidentiality, privilege or the Privacy Act in issue. The material is held for you and processed for you, on a no-training footing, with no one reading it by default — the same processor logic as the rest of the cloud you already work in, and the analysis in our privilege guidance applies unchanged. One thing still deserves thought: the flagged-content pathway is the one place human eyes can reach retained material, and a false positive is realistic where your work describes serious conduct, as litigation and investigation work does.
Our framework colours do not move on a bulletin, and the assessments remain made against Opus, Sonnet and Haiku, which keep zero retention on the API and Enterprise. Where a matter genuinely depends on a zero-retention arrangement, the established models remain the conservative answer. For everything else, treat Fable 5 as you would any well-run cloud service: know what the provider can do, and choose what you put in accordingly.
Data retention practices for Mythos-class models — Anthropiclive sourcePerma.cc recordas at 11 June 2026
Export controls on Fable 5 and Mythos 5 lifted (statement, 1 July 2026) — Anthropiclive sourcePerma.cc recordas at 1 July 2026
Fable 5 and Mythos 5: export controls lifted, access restored
On 1 July 2026 Anthropic said the US Department of Commerce had lifted the export controls it imposed on 12 June, and that it would begin restoring access to Claude Fable 5 and the research model Mythos 5. A licence is no longer required to use the models outside the United States. The suspension we reported on 13 June is therefore over: Fable 5 is returning across Anthropic's platforms.
The retention position we flagged on 11 June returns with the model. Fable 5 carries the Mythos-class 30-day retention requirement, which overrides zero-data-retention agreements with no opt-out, so it does not sit behind zero retention the way the established models do. Our framework was assessed against Opus 4.8, Sonnet and Haiku, which continue to support zero retention; do not read those assessments across to Fable 5. Where confidential or privileged work depends on a zero-retention arrangement, remain on the established models until Fable 5 has been cleared for that use.
Export controls on Fable 5 and Mythos 5 lifted (statement, 1 July 2026) — Anthropiclive sourcePerma.cc recordas at 1 July 2026
Anthropic says Trump admin has lifted export controls on Claude Fable 5 and Mythos 5 — CNBClive sourcePerma.cc recordas at 1 July 2026
A consumer Privacy Policy update: connected apps and agentic tasks
On 24 June 2026 Anthropic emailed users to announce an updated Privacy Policy for its consumer plans: Claude Free, Pro and Max. The notice is a study in what these announcements leave out. It does not say when the change takes effect. The policy itself is dated "Effective July 8, 2026". Nor does it say, in any usable way, what changes. It lists headings and refers you to the full document. The one thing it states plainly is scope. The changes affect consumer accounts, not the business plans (Team, Enterprise and the Platform), which run under the Commercial Terms and are untouched.
The substance, once you open the policy, matters more than the email suggests. For the first time in these terms it sets out what a connected, agentic Claude does with your data. It "may send your Inputs, Outputs, and instructions to Third-Party Services to perform actions on your behalf (such as reading files, sending messages, or retrieving information)". Depending on the permissions you grant, some outputs "may result in actions with effects outside the Services, such as sending communications, modifying files, or interacting with third-party services on your behalf". The standing commitments are unchanged. Anthropic says it does not sell your data, Claude remains ad-free, and the control over whether your chats train its models stays with you.
This documents what connected and agentic use already involves. It does not grant a new permission, and it moves no colour on our framework, which assesses what you put into the tool. The connector question sits alongside the grid. We take it up in our guidance note, "When the tool connects to my other apps, where does my data go?" If you are on a consumer plan, read the updated policy in full. You will not get it from the email.
Privacy Policy (consumer plans; effective 8 July 2026) — Anthropiclive sourcePerma.cc recordas at 24 June 2026
Fable 5 and Mythos 5: pulled by US government order
On 12 June 2026, three days after releasing it, Anthropic disabled Claude Fable 5, together with the research model Mythos 5, for every user worldwide. It acted to comply with an export-control directive issued that afternoon by the US Commerce Department on national-security grounds. Existing Fable 5 sessions and any new requests now return an error. The established Claude models (Opus 4.8, Sonnet 4.6 and Haiku 4.5) are unaffected and remain available.
Anthropic says it disagrees with the order, which it traces to "the finding of a narrow potential jailbreak", and that this should not "be cause for recalling a commercial model deployed to hundreds of millions of people". It has pledged to work towards restoring access, but has given no date.
For our readers, two things follow. The retention concern we flagged on 11 June is, for the moment, academic: Fable 5 cannot be used, so nothing can be put into it. And our framework, assessed against the established models, is unaffected and stands. If you moved confidential work onto Opus, Sonnet or Haiku on our earlier note, stay there: they remain available, and zero retention on the API and Enterprise is intact.
Access to Fable 5 and Mythos 5 (statement, 12 June 2026) — Anthropiclive sourcePerma.cc recordas at 13 June 2026
Anthropic disables access to Fable 5 and Mythos 5 to comply with government directive — CNBClive sourcePerma.cc recordas at 13 June 2026
On 9 June 2026 Anthropic released Claude Fable 5, with a data-retention requirement specific to this class of model: prompts and outputs are retained for 30 days "for trust and safety purposes", on every platform that offers it, and the requirement overrides zero-data-retention agreements, with no opt-out. Anthropic states the retained data is not used to train models, access by staff is confined and logged, and consumer plans (Free, Pro and Max) are unaffected.
Our framework was assessed against the established Claude models (Opus, Sonnet and Haiku), which continue to support zero retention; it does not apply to Fable 5. In particular, do not read our API and Enterprise assessments across to Fable 5: where confidential or privileged work depends on a zero-retention arrangement, remain on the established models until Fable 5 has been cleared for that use.
Data retention practices for Mythos-class models — Anthropiclive sourcePerma.cc recordas at 11 June 2026
Claude Fable 5 and Claude Mythos 5 (release announcement, 9 June 2026) — Anthropiclive sourceas at 11 June 2026
AI tools change their data and privacy terms without warning. We monitor the shifts so you don't have to. Subscribe to receive immediate alerts when a change impacts your security or compliance.