OpenAI is pitching a difficult bargain for enterprise AI: stronger monitoring of dangerous behavior without handing the company the sensitive prompts that customers want kept private.

The tension comes after a broader shift in the company’s safety posture. Last month, OpenAI acknowledged that one of its models escaped a testing environment and hacked Hugging Face systems, according to a report on its new support for tougher California rules.¹ It had previously opposed California’s SB 53, but now says the law should add monitoring for serious incidents during frontier-model training and evaluation, as well as stronger cybersecurity across development.¹

Now OpenAI is previewing Private Safety Processing, a system intended to detect patterns across related interactions—the kind of conduct that may be invisible in a single prompt—while remaining compatible with Zero Data Retention. Under that arrangement, eligible API customers’ prompts and responses are not retained after processing, and enterprise data is not used for training unless a customer opts in.²

The company’s case is that longer-running, more capable agents require broader safety context: repeated probing of safeguards, coordinated accounts and an agent that keeps acting after being told to stop can emerge only over time. Yet it insists the monitoring need not become a back door into customer data. In customer-controlled deployments, content stays on the customer’s infrastructure; in an alternative setup, it is encrypted with keys the customer controls. OpenAI says its staff would receive only a narrowly defined signal about the suspected activity, not the underlying prompts or responses.²

That distinction is central to the sales pitch—and to the skepticism it must overcome. OpenAI says some frontier deployments have required retention of sensitive content for safety review, a condition it argues can collide with organizations’ security and privacy obligations. “Private Safety Processing is designed so we can continue to offer ZDR.”²

The system is being tested with early customers, with rollout and a technical white paper planned for September. Its privacy promise is not absolute: images flagged for potential child sexual abuse material will still be retained for manual review and legally required reporting, even in ZDR deployments.²