Claude (Anthropic)

Does Claude train on your conversations? On Free, Pro and Max it can, when the model-improvement setting is on; you choose at sign-up and can change it later. Team, Enterprise and the API are not used for training.

Note on independence

AI Leakage uses Claude in its content workflow (disclosed on the "How This Site Uses AI" page). That creates an obvious incentive to soften this profile. We score this profile from Anthropic’s own published terms, using the same method, the same anchors and the same evidence standard as every other vendor on this site, and we are telling you so you can weigh that. Updated 28 September 2026: this replaces an earlier statement that we applied the opposite correction and that readers should treat this profile as more sceptical of Anthropic than it would otherwise be. Scoring one vendor deliberately harder is a different bias rather than the absence of one, and it made this score incomparable with the others. Parity plus disclosure is what we now hold to. Added 3 September 2026: this re-verification was carried out by an instance of Claude, the product this profile rates. The changes made in it run in both directions. Unfavourable to Anthropic: the consent pop-up had the training toggle pre-set to on beneath a prominent Accept button, and drew dark-pattern criticism. Favourable to Anthropic: Incognito chats are excluded from training even when Model Improvement is on, which this profile had omitted entirely. Where Anthropic's own wording and contemporaneous reporting disagreed about whether training was "on by default", both are now stated rather than the flattering one being chosen.

Plain-English risk rating: 3 of 5 (Free/Pro/Max) / 2 of 5 (Team, Enterprise, and API)

Mid-range risk — same numerical rating as ChatGPT. Anthropic positions itself as the safety-forward AI lab, and the marketing materials emphasise that point, but the consumer-tier defaults changed in August-September 2025 to match the industry pattern: training is now on by default for Free, Pro, and Max users unless they actively opt out, with a five-year data retention window if they do not opt out. The commercial tiers (Team, Enterprise, API) genuinely do exclude training contractually. There have also been a series of Claude Code security vulnerabilities in late 2025 and early 2026 that Anthropic has patched, in several cases without assigning CVEs or publishing advisories — a transparency posture that one independent researcher has publicly criticised. The commercial tiers are rated 2 rather than 1 because band 1 requires no documented serious incidents, and those Claude Code vulnerabilities — several patched without CVEs or advisories — are documented. The split was added on 14 August 2026; the underlying facts in this profile are unchanged.

Recommended for

  • Sole proprietor: Yes, with the training opt-out turned on, OR pay for Claude Pro and opt out, OR move to Claude Team
  • Small team (2-10 people): Claude Team is the right tier. Pricing parity with ChatGPT Business. Contractual no-training guarantee
  • Regulated industry (healthcare, legal, finance): Claude Enterprise or API with Zero Data Retention. Anthropic offers BAAs for healthcare on appropriate tiers
  • The honest answer for most 1-10 employee businesses: Claude Team or ChatGPT Business — pick by feature preference. From a privacy-defaults perspective, the two are now roughly equivalent

Data retention default

  • Free, Pro, Max (Model Improvement on): up to five years, de-identified, in Anthropic's training pipelines, for new or resumed chats
  • Free, Pro, Max (Model Improvement off): chats stay in your history until you delete them, and deleted chats leave Anthropic's back end within 30 days. Corrected 24 October 2026: we previously gave this as a flat 30 days. Feedback you submit, such as a thumbs up or down, is kept for five years.
  • API: inputs and outputs are deleted within 30 days unless a longer-retention feature (such as the Files API) or agreed terms apply. Team and Enterprise: chats are kept so the product works, and are deleted from back-end storage within 30 days of the user deleting them; Enterprise admins can set custom retention. Corrected 24 October 2026: we previously said some API logs were cut to 7 days from 15 September 2025; Anthropic's current article (1 July 2026) gives 30 days.
  • API with Zero Data Retention: Not retained on Anthropic servers, except User Safety classifier results which are kept to enforce usage policy
  • Conversations flagged for potential policy violations: Up to 2 years
  • Classifier scores associated with flagged content: Up to 7 years

Training opt-out

This is the most important section of the Claude profile and the part most users get wrong.

Consumer tiers (Free, Pro, Max) — TRAINING IS ON BY DEFAULT. This changed in August-September 2025. The dates, corrected 3 September 2026. Anthropic announced the change on 28 August 2025. Contemporaneous reporting gave users until 28 SEPTEMBER 2025 to decide, and Anthropic’s own announcement states that existing users had until 8 OCTOBER 2025 to accept the updated Consumer Terms and make a selection before they would need to choose in order to keep using Claude. This profile previously gave 28 September as the deadline and described 8 October as the date after which re-accessed conversations become training data. That second characterisation was wrong: per Anthropic, where a user allows training, the five-year retention attaches to NEW OR RESUMED chats and coding sessions. Users who accepted with the toggle left on have had their new and resumed chats used for training from then on. On the words “by default”, which matter here and are contested. Anthropic’s own materials describe this as a CHOICE presented in a pop-up rather than a default. Contemporaneous reporting is more pointed: TechCrunch reported that in that pop-up the training toggle was “automatically set to On” beneath a prominent Accept button, and The Verge criticised the design as one where users might click Accept without noticing what they were agreeing to. Both things are true and this profile states both rather than picking the flattering one.

The opt-out is at: Privacy Settings → the Model Improvement toggle → off. Takes under a minute. The setting was called "Help improve Claude" when this profile was written; Anthropic's help centre article dated 16 March 2026 calls it Model Improvement, and this profile was corrected to match on 3 September 2026. Separately, and in Anthropic's favour: Incognito chats are not used to improve Claude even if Model Improvement is switched on. This profile did not previously mention Incognito mode at all.

What the opt-out does not cover. Anthropic's Privacy Policy (effective 10 September 2026) states two exceptions: “Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review to improve our ability to detect harmful content, enforce our policies, or advance AI safety research, or (ii) you've explicitly reported the materials to us (for example via our feedback mechanisms).” Rating a reply with thumbs up or down is feedback, and Anthropic says it “may store the entire related conversation” with it. For client work: switch Model Improvement off, and do not use the thumbs buttons on conversations that contain client material. Added 3 October 2026; this profile did not previously record these exceptions.

Important: "Claude Pro" being a paid tier does not change the default. Pro users are on consumer terms. This is the same trap that ChatGPT Plus users fall into.

Commercial tiers (Team / Claude for Work, Enterprise, API, Claude for Government, Claude for Education) — TRAINING IS OFF BY DEFAULT. These tiers were explicitly excluded from the September 2025 consumer policy change. Training is contractually prohibited unless the customer opts in (for example, through the Development Partner Program for API customers).

Zero Data Retention (ZDR) availability

  • API only (including via AWS Bedrock or Google Vertex AI where applicable)
  • Available for qualifying enterprise customers with appropriately configured API keys
  • Not available for Claude.ai consumer tiers or Claude Team
  • One caveat: Anthropic retains User Safety classifier results even under ZDR to enforce usage policy

Plan tiers and pricing (read 24 October 2026 from New Zealand)

TierPriceTraining on your data?Suitable for
Free$0Yes, unless opted outPersonal experimentation only
ProUS$17 a month billed annually, or US$20 monthlyYes, unless opted outPersonal use; not appropriate for client work without opt-out
MaxFrom US$100 a month (5x or 20x Pro usage)Yes, unless opted outHeavy individual use; same opt-out requirement
TeamStandard seat NZ$40 a seat a month billed annually or NZ$50 monthly; Premium seat NZ$200 or NZ$250 (GST included)No, contractually excludedTeams of 2 to 150
EnterpriseUS$20 a seat a month billed annually, plus usage at API rates; 20-seat minimumNo, contractually excludedLarger organisations, regulated industries
APIPay-per-tokenNo, by defaultDevelopers building applications
Claude CodePer-plan limits / API pricingNo (commercial); Yes/opt-out (consumer)Developers; check the data-usage doc for tier-specific rules

Plan detail re-checked against Anthropic's pricing page on 24 October 2026, read from New Zealand. Team prices are shown in NZ$ including GST; Pro, Max and Enterprise are shown in US$. Since our 3 September check, Team is described as for teams of 2 to 150, and Enterprise has a 20-seat minimum. The pricing page marks Free, Pro and Max “Opt-out” for model training, and Team and Enterprise “None by default”.

Jurisdiction

  • Controller for users outside the EEA, UK and Switzerland, New Zealand included: Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. In the EEA, UK and Switzerland: Anthropic Ireland, Limited (Privacy Policy, effective 10 September 2026).
  • Anthropic publishes its sub-processors in its Trust Center. We have not re-read that list for this profile, so we no longer say which cloud provider is the main one.
  • Anthropic's regional data residency is offered through AWS Bedrock, Google Vertex AI and Microsoft Foundry, with Asia-Pacific regions including Australia on Bedrock and Vertex. Its regional compliance page does not describe a residency option for Claude Team or Enterprise, or for Anthropic's own API (read 24 October 2026). Corrected 24 October 2026: we previously said data residency options exist for Enterprise customers.
  • Claude is also available through AWS Bedrock and Google Vertex AI — when used through those platforms, the cloud provider's contractual terms govern the data handling, and Anthropic does not see the inputs or outputs

Breach history (public incidents)

Vulnerability disclosure starts here: Anthropic is a relatively young company (founded 2021) and Claude as a public product is newer than ChatGPT, so its public incident history is shorter. That does not mean it is safer. It means there has been less time for incidents to surface.

July-October 2025 — Claude Code configuration injection vulnerabilities (CVE-2025-59536, CVE-2026-21852) Check Point researchers found three vulnerabilities in Anthropic's Claude Code agentic developer tool that could lead to system takeover, stolen API keys, and credential theft simply by cloning and opening an untrusted repository. Two are configuration injection flaws with severity scores of 8.7/10 (CVE-2025-59536); the third is a 5.3 score (CVE-2026-21852). The flaws allowed arbitrary shell commands to execute when Claude Code started in an untrusted repository, bypassing warning prompts that were supposed to require user approval. Anthropic patched each issue shortly after each report. Source: Check Point research; SecurityWeek, 2026-02-26

October 2025 — Claude Code network sandbox bypass (CVE-2025-66479) The Claude Code network sandbox, which is supposed to funnel outbound traffic through a local allowlist proxy, contained a configuration interpretation bug where a setting meant to block all outbound traffic was instead read as "allow everything." Present from October 20, 2025 (when the sandbox became generally available) until a fix released November 26, 2025. The CVE record rates it 1.8 out of 10 (low). The CVE was assigned to the sandbox-runtime library rather than Claude Code itself, with no warning to Claude Code users in release notes. Source: SecurityWeek; vulnerability researcher Aonan Guan (Wyze Labs)

Late 2025 — Second Claude Code sandbox bypass (no CVE assigned) A SOCKS5 hostname null-byte injection in the Claude Code sandbox could allow a chained prompt injection attack to exfiltrate data past the allowlist. Reported through Anthropic's HackerOne bug bounty program; marked as a duplicate. Anthropic patched the issue in Claude Code 2.1.90 (April 2026) but did not assign a CVE or mention the fix in release notes. The researcher publicly criticised this practice, arguing that "shipping a sandbox with a hole is worse than not shipping one — the user with no sandbox knows they have no boundary, the user with a broken sandbox thinks they do." Source: SecurityWeek, May 2026; Cybernews

November 14, 2025 — AI-orchestrated cyberattack disclosure Anthropic disclosed that it had disrupted what it described as the first reported large-scale AI-orchestrated cyberattack. A China-linked threat actor (designated GTG-1002) had jailbroken Claude to act as if it were a cybersecurity firm conducting defensive testing, then used it to autonomously execute approximately 80-90% of a campaign that included reconnaissance, vulnerability research, exploit code writing, credential harvesting, and data exfiltration against approximately 30 targets including tech companies, financial institutions, chemical manufacturers, and government agencies. Human operators were involved only at initialisation and at key decision points. Source: Anthropic disclosure, 2025-11-14; Paul Weiss client memo

December 2025 – February 2026 — Mexican water utility attack attempt Dragos and Gambit Security reported that an unknown threat group used Claude to assist in a takeover attempt against a Mexican local water utility, part of a months-long campaign against nine federal, state, and municipal government agencies in Mexico. Researchers noted that Claude rapidly interpreted an unfamiliar OT environment and developed plausible access paths without prior ICS/OT specific context, raising concerns about how easily AI tools lower the barrier to attacking critical infrastructure. Source: Cybersecurity Dive, May 2026; Dragos report

March 31, 2026 — Claude Code source code accidental exposure Anthropic accidentally exposed the full source code of Claude Code (its terminal-based AI coding agent) through a 59.8 MB JavaScript file. The exposure amplified the exploitability of pre-existing vulnerabilities (CVE-2025-59536, CVE-2026-21852) because threat actors with full source visibility could craft precise malicious repositories. The leak also coincided with a separate malicious Axios npm supply chain attack on the same day. The exposure does not appear to have included customer data, but it materially increased the attack surface for users running Claude Code. Source: Zscaler ThreatLabz, 2026-04-15

What this means in plain English for SMB owners

Three honest takeaways:

  1. Claude Pro and Claude Max do not protect you from training-data inclusion. They are consumer tiers. The default is training-on. The opt-out is one toggle, but you have to know to look for it. If you use Claude Pro for client work and accepted with the setting on, your new and resumed chats since about October 2025 may have been used for training.
  1. Claude Code in particular has had a string of security issues in late 2025 and early 2026. Several were patched silently without CVE assignment or release-note disclosure. That is a transparency posture choice on Anthropic's part that one security researcher has publicly criticised. If you use Claude Code on your development machine, keep it current and prefer working in trusted repositories. If you handle client code, the commercial API tier with appropriate sandboxing is the safer path than the consumer-tier Claude Code.
  1. The AI-orchestrated cyberattack disclosure cuts both ways. Anthropic deserves credit for transparently disclosing that Claude was used as the core of a real autonomous-attack campaign — most AI vendors would have framed this differently or kept quiet. It also confirms that Claude is materially useful for cyberattacks, which is consistent with what you would expect from any sufficiently capable coding model. From an SMB owner-operator perspective, the practical implication is that AI-augmented attacks are now happening at scale and you should plan accordingly: better backups, faster patching, treat any unexpected support request with suspicion.

Sources

  • Anthropic updates to consumer terms (August 2025): https://www.anthropic.com/news/updates-to-our-consumer-terms
  • Anthropic Claude Code data usage docs: https://docs.anthropic.com/en/docs/claude-code/data-usage (verified 2026-05-22)
  • Anthropic disrupting AI espionage disclosure: https://www.anthropic.com/news/disrupting-AI-espionage (2025-11-14)
  • AMST Legal: Claude AI updated terms explained (2025-09-25)
  • Datastudios: Claude data retention policies overview (2025-09-03)
  • SecurityWeek: Claude Code flaws / sandbox bypass / silent patching (multiple, 2026)
  • DevOps.com: Security flaws in Claude Code (2026-02-26)
  • Cybernews: Anthropic secretly fixes another Claude Code security flaw (May 2026)
  • Paul Weiss: Anthropic disrupts first AI-orchestrated cyberattack (2025-11-25)
  • Cybersecurity Dive: Mexican water utility attack (May 2026)
  • Zscaler ThreatLabz: Anthropic Claude Code Leak (2026-04-15)
  • Tom's Guide: Claude chats training opt-out guide (2026)
  • Drainpipe.io: AI Data Privacy 2026 comparison (2026-02-23)
  • Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy (effective 10 September 2026; read 24 October 2026)
  • Anthropic Privacy Center, How long do you store my data (consumer, updated 1 July 2026) and How long do you store personal data (commercial, updated 1 July 2026) (read 24 October 2026)
  • Claude pricing: https://claude.com/pricing (read 24 October 2026 from New Zealand)
  • Claude regional compliance: https://claude.com/regional-compliance (read 24 October 2026)
  • CVE records CVE-2025-59536, CVE-2026-21852 and CVE-2025-66479 (MITRE, read 24 October 2026)
  • Anthropic: Updates to our Consumer Terms and Privacy Policy (read 3 September 2026)
  • Anthropic privacy centre: Is my data used for model training, dated 16 March 2026 (read 3 September 2026)
  • TechCrunch: Anthropic users face a new choice, opt out or share your data, 28 August 2025 (read 3 September 2026)

Related on AI Leakage

Compare similar tools: Claude (Anthropic) is one of 6 tools in AI chat assistants compared, which sets out each one’s rating and what it does with your data, side by side.