Letting ZDR and multi-turn safety coexist
On August 19, OpenAI released a preview of Private Safety Processing in its official blog, attempting to draw a new line between safety on frontier models and the "Zero Data Retention (ZDR)" promise: when customers choose ZDR deployment, customer content stays on infrastructure they control, or is encrypted on OpenAI infrastructure with keys held by the customer; automated systems can flag patterns of potential misuse across multi-turn interactions and return a deliberately narrowed "event type + severity" signal to OpenAI, while OpenAI personnel never see the raw customer prompts or replies (openai.com).
Glean's CISO Sunil Agrawal offered one-sentence social proof in the announcement: "OpenAI's no-training commitment and ZDR give us confidence to build on OpenAI. As models become more capable, OpenAI shows safety can advance without compromising the privacy and control that sustain enterprise trust." That is the most prominent enterprise endorsement OpenAI has publicly attached to its ZDR path so far.
Why it is not "zero data" vs "zero safety"
OpenAI states the design intent plainly: many serious safety risks only become visible when multiple turns are viewed together (the same person repeatedly probing guardrails, coordinated behavior across accounts, threats disguised as routine research), and single-turn evaluation cannot surface them. The problem is that, until now, to let a safety system see that "cross-turn" pattern, OpenAI had to retain customer content for human + automated review — once customers insist on ZDR, that path is closed.
The trade-off in Private Safety Processing is that OpenAI receives a clipped signal ("suspected CSAM", "suspected misuse pattern", etc.), not the content itself. Even for requests the automated system flags, the underlying customer content is never returned to OpenAI personnel; customers receive the full alert, can investigate, file appeals, or, voluntarily, supplement relevant context back to OpenAI to support an investigation. Starting in September, Private Safety Processing will formally roll out, alongside a technical white paper.
The Astra model hitting the cybersecurity "critical" threshold
The other disclosure in the same announcement explains why OpenAI is rebuilding its safety + ZDR coexistence pipeline now. On August 7, OpenAI internally confirmed that its unreleased Astra model has reached the "Critical" cybersecurity capability threshold under OpenAI's own Preparedness Framework. That internal policy states explicitly that once a model crosses that line, the company must pause further training of related models until safety and alignment work meets a higher bar.
OpenAI's August 18 announcement and Fortune's same-day reporting together lay out the next steps: OpenAI has split its workload into two tiers — smaller-scale training and evaluation have resumed after the new monitoring, sandboxing, network isolation, and multi-stage chain-of-thought (CoT) supervision landed; but a substantial fraction of Astra training / RL evaluation still sits paused, with safety- and alignment-related work prioritized to migrate into the hardened environments (Fortune).
The engineering tax is quantified: this hardened monitoring + sandbox + CoT supervision stack adds roughly 20% additional inference compute. OpenAI's chief scientist Jakub Pachocki added a primarily organizational argument at the press briefing — "the more capable you train, the more you need to be confident you can measure capability, safety, and alignment."
Why this article avoids strong claims (SOTA, first, etc.)
Much of the tech press uses language like "first," "SOTA," or "only" when writing about events like this one. This article deliberately avoids that pattern — OpenAI's announcement itself uses progressive-tense language ("previewing," "currently testing with early customers," "planning to start rolling out in September"), not absolute statements like "world's first." The conclusion that "abuse risks for frontier-model ZDR customers only become visible across turns" points in the same direction as OpenAI's design but currently rests only on OpenAI's own public materials, so this article treats it as an officially stated position, not as independently verifiable fact.
What this means for enterprise users
If you are designing an enterprise deployment on top of frontier models, the "pretty" ZDR line no longer automatically implies "complex, multi-turn attack patterns will be seen." Private Safety Processing's trade is: OpenAI sees event type and severity, not the event itself. Legal and data-protection teams at "supply-chain" customers (vendors who plug these models into their own end-customer data products) should write this change into vendor reviews and external compliance statements before the September rollout: from this point forward, ZDR's boundary has quietly expanded from "OpenAI does not see my content" to "OpenAI sees structured safety signals, and I get to decide whether to add context."