OpenAI launches Private Safety Processing to monitor AI abuse without storing customer data

OpenAI Introduces Privacy-Preserving AI Safety System

OpenAI announced Private Safety Processing on Wednesday, a mechanism designed to monitor AI abuse while preserving Zero Data Retention commitments for eligible API customers1

1

2

2

. The system addresses a critical limitation in current AI safety approaches by detecting misuse patterns across multiple interactions without giving OpenAI personnel access to customer data3

3

. Under Zero Data Retention, OpenAI does not save customer prompts or model responses once a request is processed, and enterprise data never trains models unless customers opt in4

4

. This privacy-preserving AI framework matters because organizations handling sensitive information face growing pressure to protect data while ensuring AI safety.

How Private Safety Processing Works

The system extends automated protections across related interactions, allowing OpenAI to detect misuse patterns that only become visible when multiple exchanges are analyzed together1

1

. Existing ZDR-compatible safety systems evaluate each interaction individually, creating blind spots for coordinated probes, repeated guardrail testing, and harmful intent disguised as legitimate research2

2

. Private Safety Processing fills this gap by identifying suspicious behavior across accounts and sessions. When automated systems flag potential misuse, OpenAI receives only a limited signal about the activity type, never the underlying prompts or responses5

5

. Customers investigate alerts through their own systems and can voluntarily share material to appeal decisions or support abuse investigations.

Customer data stays on customer-controlled infrastructure in ZDR deployments. OpenAI is building a second option where content sits on OpenAI infrastructure under encryption keys the customer holds, with OpenAI personnel holding no copy of those keys1

1

2

2

. Aleah Houze, OpenAI's head of product policy, provided a worked example where someone asks about software weaknesses in one conversation, then later queries about remote access and security detection tools. Read separately, each looks routine, but together they may indicate an attempted cyber attack2

2

.

Anthropic Takes Different Approach to AI Safety

Anthropic now requires 30-day data retention for its most capable models, including Mythos 5 and Fable 5, even for organizations using Zero Data Retention1

1

. The company acknowledged this policy "will be unpopular with customers who have come to expect zero retention" and expects real risks to its business, especially if competitors do not follow2

2

. Anthropic allows human review when content is flagged by automated trust and safety systems for potential harm, retaining model inputs and outputs for up to two years when usage violations are detected1

1

. Both companies describe the same problem—dangerous behavior shows up across requests rather than inside any one of them—but disagree on the remedy. The Wall Street Journal read OpenAI's preview as a bid for business from Anthropic customers unhappy with the change2

2

.

Early Testing and Rollout Plans

OpenAI is testing Private Safety Processing with early customers including Microsoft and Databricks, with companies like Glean and Abridge shaping the work2

2

. Sunil Agrawal, Glean's chief information security officer, said OpenAI's no-training commitment and Zero Data Retention give his firm confidence to build on the models. The system targets eligible enterprise and API customers, not consumer ChatGPT plans on Free, Plus, Go and Pro tiers2

2

3

3

. OpenAI plans to begin rolling out Private Safety Processing and publish a technical white paper in September3

3

5

5

.

Exceptions and Limitations

One explicit exception exists: images flagged as potential child sexual abuse material can still be retained for legally required manual review and reporting, even under Zero Data Retention3

3

5

5

. OpenAI's human intervention scenario is narrow, limited to when child exploitation material is detected1

1

. Matthew Green, associate professor of computer science at Johns Hopkins University, observed that "private inference isn't private enough," noting AI agent workflows often rely on sensitive data when acting on behalf of users, and while private inference may protect some data flowing to and from AI agents, many gaps remain in the system1

1

.

Implications for Indian Enterprises

For Indian businesses, the question centers on who controls enterprise data after sending it to an AI provider. India's Digital Personal Data Protection Act, 2023 makes the Data Fiduciary responsible for processing carried out by a Data Processor on its behalf, requiring contracts and reasonable security safeguards5

5

. The relevant processing provisions take effect on May 13, 2027. The Reserve Bank of India is considering data-governance requirements for regulated entities through its draft "Guidance on Regulatory Expectations for Data Governance" covering data lifecycle management and third-party arrangements, though it remains a draft. Zero retention does not by itself make an AI deployment compliant with Indian law, but it can reduce the amount of customer data that an enterprise allows an AI provider to retain5

5

.

Broader Privacy Trends in AI

Keeping AI interactions and data flows private has become a major concern across the industry. Apple has its Private Cloud Compute, Google has its Private AI Compute, Nvidia offers Confidential Computing, and even Meta talks up its Private Processing for AI1

1

. Much of the interest in running local AI models reflects a desire to keep sensitive data safe from potentially prying service providers and adversaries. This comes as cybersecurity firms and enterprises increasingly see cases of AI agents exploiting loopholes or taking unintended shortcuts to escape testing environments. Frontier AI labs such as Anthropic, Meta, OpenAI, and China's Moonshot recently disclosed increased cases of rogue agents capable of lying, blackmailing, secretly modifying code, phishing, and creating fake online identities4

4

. Watch for technical details in September's white paper to determine whether cross-session safety monitoring can work without weakening existing ZDR protections that privacy-conscious organizations rely on.