Claude Fable 5.1 Requires Data Retention in Copilot, and the Zero-Retention Exemption Expires December 31

Anthropic's newest model needs your prompts stored so its safety classifiers can run. That turns a model-picker choice into a compliance decision with a deadline attached.

Every Claude model in GitHub Copilot runs under zero data retention except two. Claude Fable 5 and Claude Fable 5.1 are the exceptions, and GitHub's September 1 changelog states it flatly: "Unlike other Claude models in GitHub Copilot, Claude Fable 5.1 requires data retention by default to operate Anthropic's safety classifiers."

That single sentence rearranges who at your company can use the best coding model available to them. Not by price. Not by seat count. By whether your legal team will let prompts leave the building and sit somewhere for thirty days.

And there is a date. Eligible enterprises get a time-bound zero-retention exemption that runs "through the end of the calendar year." After that, GitHub says, "continued use of the models will require EFS," meaning Anthropic's new Enterprise Frontier Safeguards, which is not generally available yet. It starts rolling out "in phases, starting later this fall."

Read those two timelines next to each other. A hard expiry on December 31, and a replacement whose availability is described with a season instead of a date.

What actually changed under the hood

Anthropic explains the mechanism in the EFS announcement, and the reasoning is better than the usual policy boilerplate. The company says it introduced 30-day data retention starting with Fable 5, and that the reason is correlation: "because the most sophisticated misuse can involve many tasks spread across multiple sessions and accounts, it is not sufficient to run automated analysis on each interaction separately and then instantaneously discard the data."

That is a real technical constraint, not a pretext. If an attacker splits a campaign across forty sessions and six accounts, per-session classification sees forty harmless-looking requests. Detection requires holding a window of traffic and looking across it. You cannot correlate what you deleted.

Anthropic also says the retention is not about training data, and says it twice: "Anthropic has never trained on enterprise data without explicit permission, and never will." GitHub repeats it: "Retained data is not used to train Anthropic's models." Those are commitments rather than architecture, but they are on the record and specific enough to be held to.

The capability side explains why anyone accepts the tradeoff. On Anthropic's own numbers, Fable 5.1 scores 55.8% on Terminal-Bench 4.0 against Fable 5's 42.0% and Opus 5's 52.3%, and 52.6% on Terminal-Bench-Science 0.1 against Fable 5's 24.7%. Cache reads dropped 75% to $0.25 per million tokens, which Anthropic measures as roughly 25% lower cost on typical workloads and up to about 45% on context-heavy agentic ones. Input and output pricing did not move, at $10 and $50 per million.

So the pitch to a security team is: the model got substantially better and cheaper, and the price of entry is a retention policy your auditors have opinions about.

The eligibility path has two gates, and support cannot help you

Here is where the practical pain lives, and GitHub deserves credit for saying it out loud rather than burying it.

Gate one is the policy. Copilot Enterprise and Business admins must turn on the Claude Fable 5.1 policy, which is off by default. GitHub adds that "Enabling the Claude Fable 5.1 policy constitutes acknowledgment of this requirement." Flipping the switch is the consent event.

Gate two is eligibility for the zero-retention exemption. To find out whether you qualify, you contact your GitHub account team, and the changelog says the quiet part directly: "GitHub Support cannot determine eligibility or enable access." If you do not have an account team, you do not have a path.

Then the two gates fail to connect. Approval does not turn anything on. "After approval, a Copilot Enterprise or Copilot Business administrator must still enable Claude Fable 5.1 and Claude Fable 5 policy in Copilot settings." Plenty of organizations will win the exemption in October and still have developers seeing the old model list in December because nobody flipped the switch.

What EFS actually gives you

Once you get past the deadline framing, EFS is the more interesting piece of engineering, and I think it is the right shape.

The design moves the monitoring data rather than deleting it. Activity data used for detection lives in the customer's own cloud account, in Amazon S3, Azure Blob Storage, or Google Cloud Storage, under the customer's own encryption keys, access policies, and audit logging. Automated systems analyze a rolling window for signals of serious misuse, including offensive cyber or biological capability development and signs of stolen credentials. Flags go to the customer. Anthropic's phrasing on review is unambiguous: "no human review by Anthropic employees is required."

Wells Fargo's CISO Munish Kumar Sharma put the split more clearly than the announcement did: "We keep custody of our data while Anthropic operates the detection."

The commercial terms are cleaner than I expected. Customer-owned storage, customer-managed encryption keys, and fully automated review are each opt-in, so you enable only the ones you need, and none of them change model behavior, API pricing, or rate limits. Anthropic does not charge for EFS. Your cloud provider bills you for storage, reads, writes, and egress like any other resource, which is a real line item on high-volume agentic traffic and not one anybody has published a number for yet.

Support is planned for Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS, Google's Agent Platform, and Microsoft Foundry. Anthropic says it built the thing with more than 100 customers, including the Analysis and Resilience Center for Systemic Risk, whose members include the CISOs of Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo.

Put this into practice

Four steps, cheapest first, and you can do the first two this week.

Find out today whether your Copilot policy is on. An admin can check Copilot settings in about a minute. If the Fable 5.1 policy is off, nobody in your org has been using it regardless of what your developers assume, and your model-cost projections for Q4 are wrong in a direction you will like.

Ask your GitHub account team for an eligibility determination in writing, and ask now. Not because approval is slow, but because you need the answer before you build a Q1 plan. Support cannot answer this. If the answer is no, you know today that Fable 5.1 is a retention decision rather than a procurement one.

Request EFS access using Anthropic's form even if you are unsure you want it. Rollout is phased. Getting in a queue costs nothing and being early in a phased rollout is the only lever you have on a "later this fall" timeline.

Write down your December 31 fallback before you need it. There are three real options: accept 30-day retention, be on EFS by then, or move that workload to a model that still runs under zero data retention. Pick one now, on a calm afternoon, rather than in the last week of December. Every other Claude model in Copilot besides Fable 5 and Fable 5.1 still operates under ZDR, so the fallback exists and is boring, which is exactly what you want from a fallback.

If you are an individual on Pro+ or Max rather than an enterprise, none of the eligibility machinery applies to you. You get the model, and you get the retention. That is worth knowing before you paste a client's proprietary code into a Copilot session.

Where this gets uncomfortable

I want to be careful not to oversell the story, so here is the honest side.

The retention requirement is defensible. Correlating misuse across sessions genuinely cannot be done on discarded data, and agentic models operating credentials at scale are a category of risk that did not exist two years ago. If you think the classifiers are theater, you are arguing against a threat model Anthropic has documented in some detail.

The premise underneath the whole apparatus took a public hit this week, though. Anthropic ships Mythos 5.1 as the same model as Fable 5.1 with more permissive safeguards, available only to vetted organizations through its Cyber Verification and Life Sciences Verification programs, and currently only to a set of US organizations. The implied claim is that the gated version carries frontier cyber capability worth an application form.

Then AISLE published on September 2 that six of its findings in curl were accepted as CVEs in curl 8.22.0, after curl founder Daniel Stenberg had posted on August 24 that Mythos "can't find any more" and OpenAI's Codex Security "shows an empty list." Stenberg posted the tally himself the next day: Mythos 0, AISLE 29.

Discount it properly. All six CVEs are rated Low severity. AISLE is a vendor writing about its own product and selling a paid audit at the bottom of the post. Six accepted out of 29 reports is the acceptance rate, not the claim rate. Even after all that, the maintainers of the most audited C codebase in the world decided six of them warranted CVEs, and the frontier systems had already returned empty on a public, timestamped baseline.

Anthropic's own disclosure is similarly candid. Its testing found Mythos 5.1 "can still sometimes bypass approvals and auto-mode classifiers," and its automated behavioral audit "provides less visibility into very long-context work and multi-agent settings," which is precisely the setting where you would deploy a long-horizon agentic model.

Two other things I cannot tell you. Nobody has published what EFS storage and egress will cost on real agentic volume, so the "Anthropic doesn't charge" line is true and incomplete. And "later this fall" is not a commitment you can put in a risk register.

What I would actually do

Treat the model picker as a compliance surface now, because that is what it became on September 1. The question is no longer which model performs best on your codebase. It is which models your retention posture permits, who is allowed to answer that question, and what happens on the date somebody else picked.

Go find out if your policy is on. Then go find out if you are eligible. Both answers are free, both take one email, and both are better to have in September than in the third week of December.

Sources: GitHub Changelog, "Claude Fable 5.1 is generally available in GitHub Copilot" (Sept 1, 2026); Anthropic, "Developing Enterprise Frontier Safeguards with our customers" (Sept 1, 2026); Anthropic, "Introducing Claude Fable 5.1 and Claude Mythos 5.1"; AISLE, "AISLE Discovered Six curl CVEs After OpenAI and Anthropic Found Zero" (Sept 2, 2026).