The AI tool you bought probably runs on an upstream model you didn't choose. An upstream model is a large AI system, built and maintained by a specialist lab like Anthropic or OpenAI, that powers the product you purchased without appearing on the label. That model now ships under different safeguard configurations depending on who the buyer is. What your tool will and won't do follows from a tier decision made before your vendor wrote the sales deck. [1]
Two major AI labs have now made this explicit enough that it belongs in your purchase file.
The Same Model, Different Rules
Anthropic builds a model family called Claude. Its current generation includes two variants: Claude Fable and Claude Mythos, at version five point one. Both are the same underlying model. Fable is generally available, meaning any developer or business can build with it. Mythos ships under a different safeguard configuration, the set of rules controlling what the model will and won't do, and is available only through a trusted-access program, an application-and-vetting process restricted to approved organizations, for cybersecurity and life-sciences work, currently limited to a set of US organizations. [1]
The distinction changes what the model will do. Anthropic reports that its newest safeguards block 60 percent fewer false positives in cybersecurity tasks than before, with false positives meaning benign work the system wrongly flags . Fable can now be used to discover software vulnerabilities, though not to develop exploits for them; Mythos is calibrated for vetted researchers who need to go further. [1]
If a security tool you use wraps Claude, it wraps one of these tiers. The marketing page likely won't say which. And if the lab adjusts tier assignments for a given use case, the tool's behavior can shift without anyone at your vendor touching a line of code.
OpenAI Runs the Same Playbook
This is not one lab's quirk. Reading both companies' public announcements together, OpenAI expanded its Daybreak program in August with parallel structure. Daybreak Blue gives approved defenders access to frontier general-purpose models, including GPT Sol, with safeguards tailored for authorized defensive security work. Daybreak Red gates purpose-trained cybersecurity models like GPT Cyber, designed to reduce refusals on higher-risk dual-use tasks, behind a more restricted vetting. [3]
Two major labs, same pattern: same model, different tiers, different behavior. The tier your tool runs on depends on organizational vetting, not just which product you purchased.
Where Your Data Goes
Safeguard tiers are one variable. Data handling is another, and it has become concrete enough to negotiate at contract time.
When Anthropic introduced its Fable generation of models, it also introduced thirty-day data retention. Retention means the vendor keeps a record of the traffic passing through the model for thirty days. The operational reason: the most sophisticated misuse spreads across many sessions and accounts, and detecting it requires storing traffic over time so patterns can be correlated. A single-session view catches less. [2]
Many customers in regulated industries could not accept vendor-held retention. Anthropic's announced response is Enterprise Frontier Safeguards, or EFS. The design: automated monitoring continues, but the stored activity data moves to cloud storage the customer controls. Your organization's own Amazon S3, Azure Blob, or Google Cloud Storage, under your encryption keys. Misuse flags go directly to your team, and Anthropic says no review by Anthropic employees is required. [2]
EFS does not change how the model behaves, what the service costs, or how many requests you can send per minute. Anthropic does not charge for EFS, and cloud providers bill normal storage and data-movement fees. The company developed the design with more than 100 customers , across finance, healthcare, manufacturing, telecom, law, retail, and the public sector, together with Amazon Web Services, Google Cloud, and Microsoft Azure. Rollout is phased, starting later this fall. Until then, eligible customers on the current models get zero data retention, meaning the vendor keeps no copy of your traffic, as an interim position. [2]
This is announced architecture. It is a vendor-reported design, not a production-proven track record. But the broader point holds regardless of how EFS performs once live. Data-retention defaults are now a real purchase-time variable. Where traffic data sits, who can access it, and under whose encryption keys are questions with different answers depending on your tier.
What This Means at Purchase Time
Most business software sits on top of other software. You have learned to ask where data lives and who can touch it. AI tools add another layer: the upstream model, its safeguard tier, and the lab's data-handling policies. A tier reassignment or a lab-level policy update reaches your tool without a product release. You won't necessarily get a notification. You might just notice the tool behaving differently on requests it used to handle without friction.
This is not a reason to avoid AI tools. It is a reason to write the right questions into the purchase file before you sign.
Two Questions for Every Purchase File
Get these answers in writing before you purchase or renew any AI-powered tool:
Which exact named model, access tier, and safeguard configuration powers this tool in our setup?
What is the data-retention default, and who controls where any monitoring data is stored?
If either answer changes between purchase and renewal, treat it as a re-evaluation event. Not an incidental update to skim. A re-evaluation. Tier assignments and retention defaults are contract-level facts now, and a vendor who cannot answer both questions in writing probably does not know the answers themselves.