To use Anthropic's new model on Bedrock, AWS may have to retain and share your data

What the post flagged

This is an Ask HN-style thread, so the discussion is the story. The claim under examination: AWS Bedrock will require sharing data with Anthropic — with retention — to use Mythos and future models, including carve-outs "except in the rare cases where it's part of a safety investigation or we're legally required to keep it." For a platform whose entire enterprise pitch is data isolation, that's a notable reversal, and the thread's first instinct was to ask why AWS would agree.

A high-karma regular gave the unsentimental answer:

"demand for the model is unprecedented and the only downside for Anthropic if AWS rejected would be some revenue pushed a quarter away as they get Fable ready on their recently acquired compute from xAI and Google." — baq

The enterprise objection is concrete

The practical worry wasn't abstract privacy — it was what actually flows through these endpoints:

"'30-day retention for advanced models' sounds reasonable in isolation, until you remember many teams are sending proprietary code, internal docs, or customer-sensitive context through these systems." — Torikul007

Someone in a regulated shop confirmed the chilling effect is already policy: "Our corp doesn't allow usage of local models because of concern about potential 'agent sends out code to the net' issues," and noted FedRAMP complications with data leaving the boundary.

The EU lawyers disagree with each other

The most informative exchange was two practitioners reaching opposite conclusions about the same regime. The skeptic — a CISO by background:

"This is not going to fly in EU." — _pdp_, on a break from CISO duties

The rebuttal argued GDPR explicitly permits exactly this when it's disclosed:

"This will fly in EU. As long as the company states the time period for which it will keep data and clean it afterwards, gdpr has no issues with the data retention. Their carve-outs for safety (public interest) and legal are also valid exceptions in gdpr as well." — dhruvrrp

A second high-karma voice backed the optimist: "Yes it will, there's a clear purpose and the customer explicitly agrees." The synthesis, from someone watching Anthropic's posture, was that the company may simply withhold the model where it can't comply — "Anthropic appears to be somewhat principled here."

Where it actually lands

The legal split is real but probably resolvable — disclosed, time-boxed retention with stated purposes is the kind of thing GDPR was built to allow. The harder problem is the one the regulated-industry commenters named: it's not whether it's legal to send your code to a model that retains it, it's whether your compliance team will let you. For FedRAMP and EU-regulated workloads, "legally required to keep it" is the phrase that turns a convenience into a liability — and the reason this particular Bedrock change matters more than its modest 30-day number suggests.