ChatSlide Calls for Exodus of Anthropic Claude Users

On 10 September 2026, Anthropic published what it called its most detailed threat intelligence report to date, describing how people had tried to misuse Claude and how those attempts were detected and shut down. The post announcing it has been seen close to fifteen million times.

ChatSlide disapproves of what that report reveals. Not the disclosure, which we think was the right call, and not the enforcement, which we think any serious platform has to do. We disapprove of the depth of behavioral analysis the report quietly confirms is running against ordinary paying developers, and we are moving our engineering work off Claude Code and onto Codex because of it.

We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies. These cases are not typical: we're highlighting some of the most sophisticated misuse we've seen. But they're especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve. We're publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.

— Anthropic (@AnthropicAI) September 10, 2026

The sentence that matters is not about weapons

Most of the coverage has focused on the lurid end of the report: influence operations, surveillance tooling, biology, missile work. Those cases are real and stopping them is not controversial.

The sentence we keep returning to is a methodological one. Describing how influence operations get caught, the report explains that bad actors "use AI to plan their campaign, choose their targets, and write the material," and that "those types of tasks produce signals that our systems are trained to detect."

Read that as a developer rather than as a journalist. The detection described there is not keyword matching, and it is not a filter sitting on a single prompt. It is inference over the shape of your work across a session: what you appear to be planning, who you appear to be targeting, what the arc of your requests implies about your intent. A system trained to recognise the silhouette of a campaign is, necessarily, a system that builds a silhouette of every user it watches in order to know which ones match.

That capability does not distinguish between an influence operation and a startup founder refactoring a billing flow at two in the morning. It cannot. It has to model everybody to catch anybody.

Where we draw the line: storage is fine, inference is not

We want to be precise, because the usual privacy argument is not our argument.

We do not object to data retention. Running a platform at scale means keeping logs, and we keep them ourselves. If Anthropic stores our prompts, that is a storage decision, and storage decisions are negotiable with contracts and encryption and retention windows.

We object to the analysis. There is a difference between holding what a customer typed and forming a durable, scored opinion about what that customer was probably trying to do. The first is a record. The second is a character assessment, produced without the subject's knowledge, on evidence they cannot see, with no notification and no appeal.

Retention is a storage decision. Classification is a character decision. ChatSlide is comfortable with the first and is leaving over the second.

The documentation makes the asymmetry explicit

This is not an inference on our part. It is in Anthropic's own published retention schedule, and the numbers are stranger than the debate has acknowledged.

Where usage is flagged by automated trust and safety systems, Anthropic's privacy documentation and platform data-retention docs describe retaining model inputs and outputs for up to two years, and trust-and-safety classification scores for up to seven. Both figures survive a Zero Data Retention agreement. Separately, since 9 June 2026, prompts and outputs for certain covered models are held for thirty days for safety work even for commercial customers who have signed ZDR terms.

Which produces the finding we think developers should sit with:

Anthropic keeps the raw inputs that triggered a flag for up to two years, but keeps the trust-and-safety score it derived from them for up to seven. The inference about a developer outlives the evidence for it by five years.

Source: Anthropic Privacy Center and Claude Platform documentation, read 10 September 2026.

For five of those seven years, there is a score describing what a company's automated systems concluded about your intentions, and no remaining record of the conversation that produced it. If that score is wrong, the material that would exonerate you has been deleted on schedule while the accusation has not. Human review exists, but the documentation describes it as available to a small set of approved reviewers through a controlled access path once content has been flagged — that is, after the automated judgment has already been made.

The replies saw the shape of it too

The reaction under the announcement was not the reaction Anthropic seemed to expect, and two threads of it are worth taking seriously rather than dismissing as noise.

The most-amplified reply, from the developer @0xerik, framed it as a competitive contrast: "OpenAI: How do we solve millennium problems. Anthropic: How can we be a pain in the ass for our users." It reads as a joke and it was received as one, collecting roughly 1,500 likes against 72,000 views. But the theory underneath it is the one we are acting on. A company allocates its best people somewhere. A report this detailed represents a very large investment in watching customers, and developers are entitled to read that allocation as a statement of priorities.

A second, more common reaction was simple astonishment at the contents — one widely-shared reply called it "the craziest shit I've read all year." That response is worth separating from ours. Being shocked that Claude was used for missile work is a reaction to the bad actors. Being unsettled that the detection worked is a reaction to the system. Most of the thread had the first reaction. We had the second, and we think it is the one with consequences for anyone shipping software.

There was also a substantial amount of straightforward applause, and we should say plainly that the applause is defensible. If you believe the primary risk is misuse, a company that catches it and publishes the details is behaving well. We simply weigh the trade differently.

Why Codex, and what we are asking

We are moving ChatSlide's engineering work to OpenAI's Codex. The reason is specific rather than tribal.

In August, OpenAI announced Private Safety Processing, a mechanism for scanning model interactions for safety risks without breaking Zero Data Retention commitments, and has been explicitly courting Anthropic's business customers on that basis. That is an acknowledgement that safety enforcement and durable behavioral profiling are separable problems. A vendor can catch the missile case without keeping a seven-year opinion about the founder debugging a checkout flow.

We are not claiming OpenAI is a more virtuous company. We are claiming that one vendor has shipped a mechanism that treats the developer's side of this trade as a real constraint, and the other has published a report demonstrating how thoroughly it does not.

So this is our ask, and we are aware it is an uncomfortable one to make in public. Developers should read their vendor's retention schedule rather than its brand. Ask what is inferred about you, not only what is stored. Ask how long the inference lives, who can see it, whether you are told, and what recourse exists when it is wrong. Then decide whether the answers are ones you would accept from any other supplier holding a seven-year file on your intentions.

We asked those questions, did not like the answers, and are leaving. We would rather say so than say nothing.