Loading story…
Nvidia, Palantir, and other large enterprises are tightening controls on external generative-AI services over concerns that proprietary prompts, interaction data, and technical metadata could be retained or exposed. Palantir reportedly sought a zero-data-retention commitment from Anthropic and may limit access to certain Anthropic models pending such assurances; Nvidia has limited Anthropic models to low-sensitivity tasks while using its internal Nemotron model family for operations. Booz Allen Hamilton has also restricted commercial Anthropic-model use for some proprietary cybersecurity work.
The concern is especially acute for organizations handling government, defense, customer, and industrial-secret information. Anthropic reportedly retains some usage data for up to 30 days to detect and prevent sophisticated abuse, while Anthropic and OpenAI say enterprise data is not used to train models by default without explicit consent. In response, customers are pursuing isolated-cloud, customer-hosted, on-premises, and air-gapped AI deployments, and in some cases have paused or cancelled evaluations that lacked zero-data-retention guarantees.
Track how attackers are adapting to this technology.
8 events from the most recent confirmed update back to the earliest known activity.
Palantir reportedly requested that Anthropic guarantee zero data retention for user data and may temporarily suspend access to certain Anthropic models on its platform until its requirements are met.
Booz Allen Hamilton took measures to prevent employees from using Anthropic commercial models for certain proprietary cybersecurity tasks, seeking to avoid transmitting confidential government and private-client information to external AI services.
NVIDIA restricted Anthropic model use to low-sensitivity work because of a lack of zero-data-retention guarantees. It uses in-house AI, including its Nemotron model family, for internal and more sensitive tasks.
A large U.S. utility cancelled planned testing of Anthropic's Fable for core power infrastructure after Anthropic would not agree to a nonrevocable zero-data-retention policy.
Novo Nordisk continued using Anthropic's Claude for some tasks while prohibiting employees from using proprietary data with the model.
Northrop Grumman chose to run open-source AI models on its own air-gapped servers instead of using OpenAI or Anthropic services.
C Spire said its OpenAI and Anthropic agreements prohibit use of its data for model training but allow collection of technical usage data. The company requested clearer explanations of what data is collected, including information about connected applications and model-use activity.
Anthropic changed its Fable policy in June to permit retention of customer data, stating that retention is intended to ensure the model is not misused. Anthropic reportedly may retain certain usage data for up to 30 days to detect and prevent sophisticated attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic drew heightened scrutiny from security and policy communities over how its **AI safety and governance commitments** are evolving and how its models are being positioned for sensitive use cases. A Help Net Security analysis reported that Anthropic’s updated *Responsible Scaling Policy (RSP) 3.0* represents a structural shift from maintaining absolute risk below fixed thresholds to a more **relative, competitor-dependent** posture—implying Anthropic may be less willing to pause or constrain capability development if peers do not. The same reporting also noted Anthropic’s launch of *Claude Code Security* as a move that unsettled parts of the cybersecurity market and raised questions about trust and vendor assurances in security-adjacent AI offerings. In parallel, Lawfare reported the Pentagon labeled Anthropic a **national security risk** tied to usage restrictions Anthropic imposed on a military contract, while also describing reporting that the U.S. military used Anthropic’s *Claude* model in initiating operations in Iran less than a day later—highlighting the tension between policy concerns and rapid military adoption of frontier AI. Separately, Anthropic announced the creation of the **Anthropic Institute**, a research unit intended to study long-term societal impacts and risks from advanced AI; the company stated its models can already discover severe cybersecurity vulnerabilities and argued that governments and industry will face near-term governance challenges as capabilities accelerate.
Jun 29, 2026
The U.S. Department of Defense has escalated a dispute with **Anthropic** over the conditions under which its AI models could be used by the military, after Anthropic reportedly insisted on limits including *no mass surveillance of Americans* and *no fully autonomous weapons*. Reporting cited in both accounts indicates Pentagon officials have discussed potentially designating Anthropic a **“supply chain risk”**—a step that could bar the company from government work and pressure defense contractors to sever ties—while at least one senior official was quoted as saying the department would “make sure they pay a price” for non-cooperation. At the same time, the Pentagon is engaging **Anthropic, OpenAI, Google, and xAI** to align all major U.S. AI providers on a common “baseline” of expectations, after contracts were signed with limited specificity and the department now wants to deploy models into DoD environments to enable broader development of AI agents with minimal human oversight. The coverage also describes the policy vacuum driving the standoff: key rules for military AI use are being shaped through ad hoc negotiations between the Pentagon and private AI firms, prompting calls for **Congress** to set durable, democratically accountable constraints rather than leaving governance to bilateral bargaining.
Jun 29, 2026
Meta suspended its internal Model Capability Initiative after an internal error reportedly made sensitive employee monitoring data broadly accessible inside the company, intensifying criticism of a program that collected workplace activity from tools including Gmail, Google Chat, Meta AI, screenshots, and usage patterns. Meta said it found no evidence of malicious activity or an external breach, but the incident renewed concerns about consent, unencrypted storage, and how far companies are going to feed AI systems with employee data. Similar privacy concerns surfaced in the Netherlands, where a watchdog said the AIVD and MIVD intelligence services mishandled bulk datasets containing personal information through weak controls, excessive retention, and inadequate oversight, raising alarms that AI-assisted analysis could be applied to unlawfully sourced or improperly retained citizen data. At the same time, new reporting and vendor changes underscored how quickly enterprise AI is expanding the attack surface and governance burden. Orca Security said **81.2%** of organizations running AI packages had at least one known vulnerability and that **99.9%** of fixable AI vulnerability alerts remained unpatched, with risks spanning agent frameworks, vector databases, exposed API keys, excessive permissions, weak authentication, and internet-facing services such as Amazon SageMaker, Azure OpenAI, and Google Vertex AI. Microsoft is adding an in-meeting Teams control to disable Copilot, Facilitator, and recap features during sensitive discussions, while broader industry debate has focused on employees oversharing data with AI assistants, the need to govern agent identities and registries, and warnings that AI prompts, memory, and orchestration layers can leak or concentrate proprietary organizational knowledge if enterprises do not retain tight control over access, telemetry, and data handling.
Jul 16, 2026