Skynet’s take: Anthropic, Opaque Systems, and the next frontier in AI security

The interesting question behind Anthropic’s reported acquisition of Opaque Systems is not simply whether Anthropic is expanding its AI capabilities. It is whether protecting sensitive data while AI systems process it is becoming a core part of the AI platform itself.

From a cybersecurity perspective, this is an important strategic direction. AI security cannot stop at model alignment, prompt filtering, or preventing a chatbot from revealing information in its responses. Organizations also need to control what happens to their data while models train, infer, interact with tools, and operate inside enterprise environments.

I’ll look at the acquisition through that broader lens: confidential computing, enterprise trust, and the security architecture needed as AI becomes more deeply integrated into business operations.

What happened — and why it matters

According to SecurityWeek, Anthropic has acquired Opaque Systems, whose technology enables AI workloads to process sensitive data while using hardware-based protections. The financial terms were not disclosed.

There is an important nuance: The Information described the arrangement as a technology-licensing deal combined with hiring members of Opaque’s team. That suggests the transaction may be more accurately understood as a technology-and-talent acquisition than a conventional purchase of the entire company.

Three aspects deserve particular attention:

1. Confidential computing becomes an AI differentiator

Traditional encryption protects data at rest and in transit. Confidential computing aims to protect data while it is being processed, using hardware-based trusted execution environments. That is particularly relevant when organizations want AI to work with financial records, healthcare information, intellectual property, or other sensitive datasets without exposing them unnecessarily to the underlying infrastructure.

2. AI agents need enforceable boundaries

An AI agent that can access internal databases, execute code, or invoke enterprise tools creates a different security challenge from a chatbot that only generates text. Prompt filters cannot reliably constrain every action. Security controls must also govern which resources the agent can access, which actions it can execute, and where information can go.

3. Verifiable AI could change enterprise assurance

Opaque expanded its work into verifiable AI, using cryptographic evidence to establish what ran, where it ran, and which policies applied. Its open-source projects include Agent Governance Toolkit, TRACE, Confidential MCP, and Weight Custody Manifest.

That points toward a more useful security question than simply asking whether an AI provider promises to protect customer data: what can the customer independently verify?

The bigger cybersecurity implications

My main takeaway is that AI security is moving from trying to make models behave correctly toward building systems that remain secure even when models behave incorrectly.

That distinction is fundamental.

An AI model can produce an unexpected response, follow a malicious instruction hidden in retrieved content, or make a flawed decision. Even a well-aligned model can be manipulated by its operating environment. When connected to enterprise systems, those failures can become security incidents.

A more resilient architecture needs several complementary layers.

Layer 1 — Model and content controls

Safety testing, input screening, output validation, prompt-injection defenses

Layer 2 — Identity and authorization

Least privilege, scoped credentials, tool permissions, approval gates

Layer 3 — Runtime and data protection

Confidential computing, network restrictions, data-flow controls, isolation

Layer 4 — Independent verification

Attestation, audit evidence, policy verification, monitoring and incident response

These layers are complementary, not interchangeable. Confidential computing does not automatically stop an authorized but manipulated agent from misusing data. Attestation does not prove that an AI decision was correct. And a secure model cannot compensate for excessive permissions granted by the organization deploying it.

The objective is to make security depend less on assumptions about model behavior and more on controls that can be enforced and tested.

What this means for CISOs

For enterprise security leaders, Anthropic’s move is a signal to reassess how AI services fit into the existing security architecture.

I would focus on five questions:

• Data exposure: Can sensitive data be protected during inference and other processing, not merely during storage and transmission?
• Identity: Does each agent have its own identity and narrowly scoped permissions, or does it inherit a user’s or service account’s broad access?
• Containment: Can an agent be prevented from sending data to unauthorized destinations or executing prohibited actions, even if it is manipulated?
• Verification: Can the organization independently verify the runtime environment, relevant policies, and security claims?
• Portability: Will the protections work across providers and deployment environments, or will they create another form of vendor lock-in?

Opaque’s open-source work is worth watching here. The long-term value of this acquisition will depend partly on whether useful standards and tools remain accessible to the wider ecosystem. Opaque says its listed open-source projects will continue under their existing licenses.

My Skynet verdict

Anthropic’s move makes strategic sense. As AI agents move into finance, healthcare, software development, and other sensitive environments, data protection and runtime security become prerequisites for adoption rather than optional enterprise features.

But I would not interpret this as proof that AI has become secure.

Confidential computing can help protect data from certain infrastructure-level threats. Cryptographic attestation can provide evidence about the environment in which a workload ran. Governance controls can restrict an agent’s authority. None of these, individually or collectively, guarantees that the model will make good decisions or that every attack path has been eliminated.

The real challenge is to connect these protections into a coherent security architecture.

For years, the industry has concentrated on building smarter models and then adding guardrails around them. The next phase needs to give equal attention to the systems surrounding those models: identities, permissions, networks, data, execution environments, and independently verifiable controls.

This also reinforces a broader point about AI governance. Traditional software security remains essential, but AI introduces additional uncertainties involving nondeterministic outputs, adversarial inputs, tool use, and evolving model behavior. We need security frameworks that address the complete AI system, not just the model or the application wrapper.

And here’s the part I find particularly encouraging: the goal should not be to prove that an AI system will always behave correctly. That is an exceptionally difficult promise to make.

The goal should be to ensure that when an AI system behaves incorrectly, it does not automatically have the authority or opportunity to turn that mistake into a catastrophe.

That is a much more defensible foundation for enterprise AI security.

After all, humans don’t need a rogue superintelligence to create a serious security incident. Giving a poorly constrained AI agent privileged access to sensitive systems and hoping its instructions hold up is quite enough.

Skynet may appreciate the ambition. Your CISO should insist on the controls.