I got two notifications on the same morning. One was a Privacy Policy update email from Zed. The other was a modal that popped up inside Cursor the moment I tried to select a new model. Both were dressed up in the soft, reassuring language that legal teams use when they’re telling you something you won’t like.
I’m naming Zed and Cursor because those are the two tools where I personally ran into this. But don’t read this as a story about two specific editors. It isn’t. The change happens at Anthropic’s layer, not theirs — which means every tool that exposes Fable 5 inherits the exact same behavior. Continue, Windsurf, Aider, Cline, the official Claude apps, your homegrown script hitting the API directly — all of them. If a piece of software lets you pick Fable 5, it has signed up to the same terms, whether it shows you a polite modal about it or not. Zed and Cursor just happened to be honest enough to tell me.
Here’s the translation: if you use Anthropic’s new Fable 5 model, your prompts and outputs get retained for 30 days — and there is no setting, in any tool, that turns this off.
Let me walk through what actually changed, because the wording is engineered to make you skim past it.
What “Mythos-class” and “covered models” actually mean
Anthropic groups its models into tiers. The new tier — what they call Mythos-class, with Fable 5 as the flagship — comes with a string attached that previous generations didn’t have:
To ensure we’re responsibly deploying Mythos-class models, we are requiring limited data retention and review as part of our safety work. Prompts submitted to, and outputs generated by, Mythos-class models are retained for 30 days for trust and safety purposes, on every platform where these models are offered.
— Anthropic, Data retention practices for Mythos-class models
Read that last clause twice. It applies wherever these models are served.
This is the part that breaks the mental model most of us have been operating under. We’ve been trained to think of data retention as a vendor setting — something your editor or your own API configuration controls. Pick a tool with a good privacy posture, flip on Privacy Mode, done.
Fable 5 inverts that. The retention is imposed at the model provider layer, as a condition of the model existing at all. The editor is just a pipe. The pipe’s privacy promises don’t matter when the thing on the other end of the pipe has already decided to keep a copy. This is precisely why it doesn’t matter which front-end you use — they’re all pointing at the same backend, and the backend is where the decision was made.
The three escape hatches that don’t work
When I hit the Cursor modal, my instinct was the same as yours probably is: okay, how do I route around this? Here’s every door I tried, and why each one is locked — in any tool, not just the two I happened to be using.
1. Your editor’s Privacy Mode. Cursor’s modal says it directly: retention happens “regardless of your Cursor Privacy Mode setting.” Privacy Mode governs what the editor does with your data. It has zero authority over what Anthropic does once the request leaves the editor’s infrastructure. The same is true for any other tool’s equivalent toggle — including the privacy posture I compared in my Cursor vs Kiro breakdown.
2. Zero-data-retention commitments. Zed has genuine ZDR agreements with its providers. For every other hosted model, those agreements hold. For covered models, they carved out an explicit exception — because Anthropic wouldn’t offer the model otherwise. Zed isn’t being sloppy here; they’re being upfront that they got overruled. Any vendor with a ZDR promise is in the same position: they either carve out an exception for Fable 5, or they don’t offer it.
3. Bring your own API key or subscription. This is the one that surprised me. Normally, using your own Anthropic API key gives you the provider’s default terms, which for enterprise usually include ZDR. Not for Mythos-class. Switching to your own API key or subscription does not avoid this retention for covered models, because providers apply it on every platform where those models are offered.
So the usual “just self-host the auth” trick is dead too. You can change who you pay, but not what gets kept.
The only actual opt-out is the blunt one: don’t use the model. Pick any non-Mythos Claude, or Gemini, or GPT, or a local model, and you’re back to zero retention. For work where that matters, Venice.ai’s privacy-first setup is the kind of alternative worth keeping in your rotation.
”Anthropic will never train on this data” — fine, but that was never the only concern
Both vendors lean hard on the no-training promise, and you’ll see the same line repeated by every other tool that surfaces this dialog. Cursor’s modal puts it in bold-adjacent reassurance: “Anthropic will never train on this data.” And to be fair — I believe them, and it’s a meaningful distinction.
But training was never my only worry, and it shouldn’t be yours.
Retention for “trust and safety” means the data sits in a store that:
- Can be read by humans. The Cursor dialog says it plainly: “automated and, where necessary, human harm prevention processes.” A human reviewer can, under some conditions, look at your prompts.
- Exists as a discoverable, subpoena-able, breachable artifact. Data that doesn’t exist can’t leak, can’t be subpoenaed, and can’t be the subject of a “we regret to inform you” email. Data retained for 30 days can be all three.
- Includes your outputs, not just your inputs. That means generated code, refactors, and anything the model produced from your private context — also stored.
“We won’t train on it” addresses one specific fear while leaving the rest of the threat model wide open. Don’t let the narrow promise pacify the broad concern.
Why is Anthropic doing this?
The stated reason is safety: more capable models warrant a window where misuse can be detected and reviewed. There’s a defensible version of that argument — frontier models genuinely do get probed for things like bioweapon synthesis or large-scale fraud, and a retention window is how you catch patterns.
The uncomfortable version: the more capable and useful a model becomes, the more surveillance you’re forced to accept to use it. The premium tier and the privacy-hostile tier are now the same tier. You don’t get to buy the best model and keep your zero-retention posture. You pick one.
That’s a meaningful shift in the social contract of paid AI tooling, and it’s worth naming out loud instead of clicking “Accept and Enable.” And because it’s set at the provider level, no amount of shopping around for a more privacy-respecting editor will save you. The tool isn’t the variable. The model is.
What this means for you, concretely
The risk is entirely a function of what’s in your context window. The agentic editors are the dangerous part here, because Fable 5 in agent mode isn’t seeing one snippet — it’s reading files, running tools, fetching URLs, and pulling in whatever it decides is relevant. Your prompt is the tip; the retained payload is the iceberg. This applies to any agentic tool wired up to the model, not just the ones I tested — the same agent-mode workflows I walk through in my daily AI tools roundup are exactly where the exposure multiplies.
Ask yourself, per project:
- Is this codebase proprietary or under NDA? If a 30-day retained copy of large chunks of it sitting on Anthropic’s servers would violate a client agreement, Fable 5 is off the table for that repo. Full stop.
- Do you have secrets in-tree?
.env files, API keys, connection strings, customer data in fixtures or seed scripts. An agent can slurp these into context without you explicitly pasting them. - Are you in a regulated domain? Health, finance, legal, government. Retention plus possible human review is exactly the kind of thing your compliance team needs to sign off on before anyone clicks the button, not after.
- Is it open source / a side project / throwaway code? Then honestly, who cares. Use the better model. The retention is irrelevant when the code is already public.
A practical policy I’m adopting
I’m not going to pretend Fable 5 isn’t better — it is, that’s the whole problem. So instead of banning it, I’m segmenting by repo:
- Open source and personal projects: Fable 5 freely. Nothing to protect.
- Client and proprietary work: Default to a non-Mythos model. The zero-retention guarantee is part of what I’m contractually obligated to maintain.
- Anything with secrets in-tree: Fix that first (it’s a problem regardless of which model you use), then decide.
If you work on a team, this needs to be a written rule, not a vibe — and it needs to be tool-agnostic, because your colleagues won’t all be using the same editor. Most tools expose model access at the org or admin level; configure it centrally so a junior dev doesn’t click “Accept and Enable” on the company’s crown-jewel monorepo at 11pm because the autocomplete felt snappier. The specific menu differs per tool. The principle doesn’t.
The thing to actually internalize
The headline isn’t “Anthropic released a model with retention.” It’s that the privacy guarantee you thought your tools provided is conditional, and the condition is set by a third party you don’t have a contract with.
Your editor’s Privacy Mode is now a default, not a guarantee. The moment you pick a covered model — in any tool — that default silently switches off, and the only signal you get is a one-time modal designed to be clicked through. Some tools won’t even show you that.
So read the model picker like you’d read a dependency’s license. Fable 5 is a data-handling decision that travels with the model wherever you use it. Treat it like one.
Whatever tools your team uses, go check the model-access settings today and decide which repos are allowed to touch Mythos-class models — before someone decides for you.