When the Lab Owns the Attestation, Who Signs for What Ran?
What happened
On 13 October, Opaque Systems announced that its team was joining Anthropic and that the company was winding down. Anthropic's only words on the record, given to The Information, are that it is licensing Opaque's technology and hiring some of its engineers. No terms, no headcount, no reason. In the two weeks since, Anthropic's newsroom has published eight posts and a public registration filing, and none of them mentions the deal.
Opaque was the most visible independent in confidential AI: a Series B at about USD 300 million post-money in February, USD 55.5 million raised in total, a platform that ran models and agents inside hardware enclaves with policy enforcement, and TRACE, the runtime-evidence standard it had taken to the Linux Foundation in August with AMD, Intel, Microsoft and TII. The platform is gone. The standard is now maintained by volunteers.
Why, according to people who were not in the room
Nobody who has written about the deal claims to know why it was done. The most repeated reading, that Anthropic wants to sell Claude into regulated industries, traces mostly to a single analyst note and cites Opaque's customer list rather than anything Anthropic said. The readings with fewer voices and better evidence point at Anthropic's own documents: a 2025 design for confidential inference written around protecting model weights, a scaling policy that concedes its top level of weight security is not yet achievable, and its authorship of the Model Context Protocol, for which Opaque had built what it described as the only verifiably governed gateway.
Both readings end in the same place: attested execution of Claude on hardware Anthropic does not control. Whether that serves the lab's own security obligations first or its sovereign and regulated customers first, Anthropic has not said, and I would not repeat either version as fact.
What the commentary agrees on
The useful signal in two weeks of coverage is not any single reading of the motive. It is a convergence. Three commentators who do not cite one another landed on the same observation.
"the party being checked now owns part of the checking."
Enterprises that had used Opaque's open tooling as an independent check now face a verifier and a verified that are the same company.
Attestation shows that approved software ran, not that it is well designed; folding the vendor into one lab's stack reduces its independence, and availability of the open projects "is not the same as maintenance."
A fourth voice said something adjacent the same week without naming the deal. A Cloud Security Alliance research note of 17 October, on Anthropic's programme of embedded independent evaluators, observed that mature assurance regimes "pair independence rules with an external party that inspects the assessors." Nobody has yet applied that sentence to a lab-operated attestation layer in print. It applies. It is the same structural objection that makes the reviewer and the reviewed an unacceptable pairing in every other assurance discipline, and the reason we argue for separating the executor from the prover rather than hardening the executor.
The counterpoint deserves equal weight. Arjun Jaggi of Cognizant, quoted in the same New Stack piece, argued that Anthropic's resources can turn Opaque's research into production-grade tooling faster than a startup ever could. He is right. Both sides are right about different things: the attestation will get better, and it will be written by the operator.
What the vendors did instead of commenting
No confidential-AI vendor published a word about the deal. Three of them shipped. NEAR AI put the design goal plainly on 22 October:
Fortanix extended its confidential AI to CNCF Confidential Containers on 18 and 19 October so that an enterprise can run a frontier lab's proprietary model on its own attested hardware, on premises or air-gapped, with twenty-three named supporters including NVIDIA, AMD, Intel and TII. Tinfoil, on 25 October, replaced about a million lines of boot firmware with three hundred lines so that a single hardware measurement covers the whole launch chain.
The pattern is clear and it is the right response from inside the attestation category: move the root of trust away from the model vendor, toward the chip vendor and the customer. That is an improvement over "trust the lab". It still leaves two things attestation cannot do. Its root remains the silicon vendor and the physical integrity of the machine, and physical memory attacks have forged attestations on current Intel, AMD and NVIDIA platforms. And it does not tell you whether the numbers that came out matched the model's reference: in independent tests this year, providers serving the same open weights diverged widely, and none of their APIs said so. We laid out both failure modes side by side in hardware attestation versus independent re-execution.
Three questions for any evidence of an AI run
If you are the one who has to show a validator, an auditor or an examiner what your AI did, the deal changes nothing about the questions and a great deal about who is answering them.
- Who produced the evidence? If it is the party that ran the model, however good its hardware, it is a self-report with a signature.
- What is its root of trust? Measured-launch attestation binds the loaded model and code. Its root is the silicon vendor and the integrity of the machine it ran on.
- What still holds if the operator has physical access? Only a check done from outside, by a party that did not run the job.
Attestation answers the first two well, and a confidential deployment from Google, Cohere, OpenAI or Anthropic will answer them better next year than this year. The third is a different signature with a different root of trust, and it is the one that makes the other two independently verifiable rather than merely attested. For Canadian financial institutions this is not an abstract question: OSFI Guideline E-23 reaches models sourced from third parties on 1 May 2027, and a validator will have to file something.
Precision matters here. Hardware attestation does bind the model and the code that were loaded; the gap is not "it attests the environment, not the model." The gap is whose root of trust the evidence rests on, and what survives an operator with physical access to the machine.
What we do
Cyberian Systems issues cryptographic receipts proving which AI model ran on which input. The receipt is signed by an independent verifier that re-checks the work and never served the request, so the evidence does not come from the operator. Live today for embeddings from open-weight models on ordinary cloud GPUs, with bring-your-own-model; verification of text generation is in research. The engineering note on what a receipt proves, and what it does not sets out the exact boundary of the claim.
Confidential computing hides your data from the operator and attests the loaded model and code. We add the one check that still applies when the operator has physical access: an independent re-check of the result.
If you have to answer for an AI system in front of a regulator, get in touch and we will walk through what a receipt would cover in your case.
Sources
- Opaque Systems, "From Berkeley research to the future of AI: Opaque's next chapter", 13 October 2026. opaque.co
- The New Stack, "Anthropic's Opaque deal and confidential computing", 15 October 2026, with the Anthropic statement to The Information, Michael Heinrich (0G Labs) and Arjun Jaggi (Cognizant). thenewstack.io
- Constellation Research, 13 October 2026. constellationr.com
- Rajesh Beri, The DAILY Brief, 14 October 2026. beri.net
- LetsDataScience, relaying AIGovernance.com, 20 October 2026. letsdatascience.com
- remio.ai, 21 October 2026. remio.ai
- Cloud Security Alliance research note on embedded independent evaluators, 17 October 2026. cloudsecurityalliance.org
- NEAR AI, "Zero data retention isn't enough", 22 October 2026. near.ai
- Fortanix Confidential AI on CNCF Confidential Containers, 18 to 19 October 2026. itweb.co.za
- Tinfoil, "Less is more", 25 October 2026. tinfoil.sh
- Anthropic, "Confidential inference via trusted virtual machines", 18 June 2025. anthropic.com
- Anthropic, Responsible Scaling Policy v3, 24 February 2026. anthropic.com
- Pulse 2.0, Opaque Series B, 12 February 2026. pulse2.com
- Linux Foundation, TRACE announcement, 25 August 2026. linuxfoundation.org
- OSFI Guideline E-23, Model Risk Management, effective 1 May 2027.