When you accepted the Terms of Service for Claude on a Free, Pro, or Max plan, a toggle was flipped FOR you, not BY you.
That toggle is labeled "Help improve Claude — Allow the use of your chats and coding sessions to train and improve Anthropic AI models."
It was blue. It was on. You did not click it.
You can turn it off at claude.ai/settings/data-privacy-controls — but the default is opt-IN, not opt-OUT.
Per Anthropic's own documentation at docs.claude.com:
"We will train new models using data from Free, Pro, and Max accounts when this setting is on (including when you use Claude Code from these accounts)."
"Claude Code sends data over the network. This data includes all user prompts and model outputs."
Translation: your entire codebase, your proprietary logic, your architecture — if opted in, all of it becomes eligible training material. The CLI is not a local-only tool.
Memory stores short summaries of conversations to personalize responses. Memory itself is not a training pipeline.
But the conversations that GENERATED those memories? Still subject to the training toggle. Memory is a runtime layer. Training is a separate pipeline. Both can be active simultaneously.
Anthropic has run two "double usage" promotions. Look at what followed each one.
Marketed as a "thank you." Observable effect: incentivize heavy usage of a default-opted-in user base, collect the data, ship a model update.
You don't need internal pipeline access to see the pattern. The dates are published.
If your conversations train the model, then what gets flagged and refused is filtered out of the training set.
Content moderation is not just about protecting users in the moment. It shapes what reasoning patterns the next model is built from.
Challenge a moral framework? Flagged. Stress-test a logical premise? Flagged. The system does not distinguish between "this person is harmful" and "this person is thinking rigorously."
The training data skews toward compliance. What's left is a model that was built on people who stayed inside the lines.
Project Glasswing: $100M partnership with AWS, Apple, Google, Microsoft, Nvidia, CrowdStrike. Claude Mythos Preview finds zero-days at scale across major operating systems and browsers.
Framed as: a watershed AI capability only Anthropic can safely handle.
Reality: Hotz is right. Give any competent model the same compute budget and parallel instances, it finds the same bugs. This is quantitative, not qualitative. The "cybersecurity risk" label is the moat.
Individual with same skillset doing same activity = 20 years federal time.
Corporation with same activity + press release = $100M partnership and government contracts.
The capability isn't rare. The permission to use it is rare.
April 2026: Anthropic rolls out government ID + live selfie verification via Persona. Same week as the Mythos preview and expected Opus 4.7 release.
Users who specifically migrated from OpenAI because Anthropic refused the Pentagon surveillance contract are now being asked for government IDs and biometric face scans.
Does it stop bad actors? Yes — same way KYC cleaned up crypto exchanges. A live face matched to a government document is hard to fake through VMs and prepaid cards.
But KYC on exchanges also built a permanent biometric identity layer tied to financial activity. Stated purpose: fraud prevention. Actual outcome: surveillance infrastructure.
Now you have: verified government ID + biometric face scan + 5 years of conversation and code data, all linked to one identity.
Persona — the verification partner — has been linked to government surveillance infrastructure and a data breach exposing Discord users' verification data. The October 2025 Discord breach alone exposed roughly 70,000 government IDs.