Anthropic Acquires Opaque Systems, Adding Cryptographic AI Attestation Ahead of IPO

Anthropic has completed a licensing deal and acquihire of Opaque Systems, a UC Berkeley spinout that built enterprise-grade confidential-computing infrastructure for AI — bringing hardware-isolated inference environments and a new open standard for cryptographic AI agent audit trails directly into Anthropic's platform, weeks before the company's expected Nasdaq IPO. Opaque, which had already counted Anthropic among its customers, announced on October 13 that it had reached a new agreement with Anthropic. Anthropic has not issued a public statement.

The deal structure, described by Constellation Research and reported by The New Stack citing The Information, is a license-plus-acquihire rather than a traditional full acquisition: Anthropic licensed Opaque's intellectual property and hired key personnel. The Information reported that those personnel include CEO Aaron Fulkerson and CTO and co-founder Rishabh Poddar, though neither company had confirmed the names at the time of reporting. Opaque co-founders Ion Stoica — also a co-founder of Databricks and Anyscale — and Raluca Ada Popa, who left Opaque's presidency in 2024 to join Google DeepMind's Frontier and Gemini Security team, did not join Anthropic.

What Opaque Built: Hardware-Encrypted Inference and Cryptographic Agent Logs

Opaque's core technology centers on Trusted Execution Environments, or TEEs — specialized hardware isolation zones within modern CPUs and GPUs that encrypt code and data in memory in a way that prevents access even by the hypervisor, the operating system, or the cloud provider operating the underlying infrastructure. When an AI workload runs inside a TEE, neither the cloud vendor's own engineers nor any party that has not been explicitly granted access can read the model weights or the user data being processed. The two dominant TEE implementations relevant here are Intel TDX, which provides VM-level isolation and reached general availability on Azure in early 2026, and AMD SEV-SNP, which Google Cloud has deployed for GPU-accelerated workloads.

TRACE — Trust, Runtime Attestation and Compliance Evidence — is the second and arguably more consequential piece of Opaque's stack. Launched at the Confidential Computing Summit on June 23, 2026, TRACE is an open standard co-developed with AMD, Intel, Microsoft, and the Abu Dhabi-based Technology Innovation Institute. Where TEEs protect data during inference, TRACE answers a different question: how does a regulated organization prove, after the fact, that a specific AI agent run used the declared model weights, did not access unauthorized data, and produced the outputs recorded in the audit log? TRACE generates cryptographically signed records of every tool call, model invocation, and data access inside a TEE session — records signed by the CPU or GPU hardware itself, making them non-repudiable in a way that software-only audit logs cannot be. The standard was contributed to Linux Foundation governance on August 25, 2026, and the agentrust-trace package accumulated approximately 135,000 PyPI downloads in ten weeks after launch, according to the Linux Foundation.

Opaque had also built three adjacent open-source tools: Confidential MCP, an extension of Anthropic's Model Context Protocol that keeps agent tool calls encrypted inside the TEE; the Agent Governance Toolkit, which allows organizations to define and enforce governance policies over agent runs; and the Weight Custody Manifest, which cryptographically binds a specific model-weight fingerprint to a specific TEE session, allowing an auditor to verify that inference was performed on the declared model and not a substituted version.

Why Anthropic Needed This: The Regulated-Industry Gap

Before the Opaque deal, Claude faced a structural barrier in its most valuable potential markets. Healthcare organizations governed by HIPAA, financial institutions under PCI-DSS and SOX, and government agencies under federal data-residency mandates share a common objection to cloud-based AI: the cloud provider, and in principle Anthropic, could access sensitive data in transit or during processing. Model capability is not the issue — Claude's benchmark performance is not in question in these verticals. The issue is the absence of a technical guarantee that data remains confidential throughout inference.

Anthropic's prior interest in this problem was visible before the deal closed. According to The New Stack, Anthropic CISO Jason Clinton appeared on Opaque's AI Confidential podcast in 2024, and Anthropic was listed among Opaque's reference customers, indicating that at least some Claude API traffic was already flowing through Opaque's TEE infrastructure for enterprise accounts. Anthropic published a design paper with Pattern Labs in June 2025 outlining a confidential-inference architecture. What the Opaque deal provides is the engineering team that built production-scale TEE deployments and the IP to integrate that capability natively into Anthropic's platform.

Anthropic's Competitive Position in Confidential AI

The confidential-computing landscape for AI is uneven. Microsoft Azure Confidential Computing, using Intel TDX, is the most mature offering for enterprise workloads, but it provides infrastructure-level isolation that applies uniformly to Azure services rather than an AI-platform-native integration with agent governance. OpenAI has no announced confidential computing stack; its customers inherit whatever isolation Azure's infrastructure provides. Google Cloud has deployed AMD SEV-SNP for GPU instances, but has not yet integrated confidential VM guarantees into the Vertex AI or Gemini API surface in a way that provides TRACE-equivalent attestation. AWS Nitro Enclaves, available since 2020, are widely used for key management but have not been positioned as an AI-inference-level confidentiality product.

What distinguishes Anthropic's post-Opaque position is the combination of hardware TEE capability with an open, hardware-rooted attestation standard already under neutral governance. TRACE's placement inside the Linux Foundation means neither Anthropic nor any other single vendor controls it — a design decision that reduces adoption friction for enterprises worried about lock-in, but that simultaneously means OpenAI or Google could also implement TRACE without Anthropic's permission. Anthropic gains the engineering depth and institutional knowledge of the team that designed the standard; whether that first-mover advantage compounds or dissipates will depend on how quickly it ships a production integration.

Read more: Anthropic Q3 Revenue Hits $16.8B But Growth Slows to 45% as IPO Target Drops to $1.5T

Pre-IPO Positioning and the Enterprise Revenue Argument

The Opaque deal lands at an inflexible moment in Anthropic's corporate calendar. The company's IPO roadshow is expected to begin the week of November 9, with a Nasdaq listing targeted before Thanksgiving. GPTS24's own reporting shows that Anthropic's IPO target valuation has been revised downward to approximately $1.5 trillion from an original target near $2 trillion, following Q3 2026 revenue of $16.8 billion and a growth rate that slowed to 45 percent year-over-year. In that context, the Opaque deal reads as a capability acquisition aimed at opening markets where Claude's revenue ceiling is currently constrained by compliance requirements rather than model performance.

Healthcare, financial services, and government AI procurement together represent a substantial share of enterprise software spending, and many of those engagements have stalled precisely on the data-sovereignty question. A Claude deployment that can offer hardware-attested data isolation and a cryptographic audit trail of every agent action is a materially different product for a hospital system, an investment bank, or a defense contractor than Claude without those guarantees. The timing of the deal — completed while the IPO roadshow window approaches — suggests that enterprise confidential-AI capability was identified as a gap that needed closing before institutional investors priced the company.

Open Questions: Customers, Open-Source Continuity, and TEE Limits

Several consequential details remain unresolved. Opaque's existing enterprise customers — including ServiceNow and Accenture — have received no public guidance from either Anthropic or Opaque about transition paths. Opaque's October 13 announcement stated that the agreement with Anthropic "carries OPAQUE's work forward" without specifying which products, at what timeline, or whether existing SLAs will be honored. The commercial Opaque platform's future is unspecified; whether its capabilities migrate into Claude's enterprise tier, remain separately available, or simply cease is unanswered.

On the open-source side, TRACE's Linux Foundation placement provides governance continuity regardless of what Anthropic does. The Agent Governance Toolkit, Confidential MCP, and Weight Custody Manifest projects do not share that protection; their GitHub repositories exist, and they have been declared open source, but Anthropic has made no public commitment to maintaining them. Developers who have integrated these tools into production workflows face genuine uncertainty about the roadmap.

The technology itself carries architectural constraints worth noting. TEEs add a measurable performance overhead — typically 10–20 percent additional latency for GPU inference under AMD SEV-SNP — and the security guarantees depend on trusting the hardware vendor's implementation. Academic research has demonstrated side-channel attacks against Intel SGX, an older TEE technology; TDX and SEV-SNP have substantially stronger mitigations but are not immune to the class of attacks that exploit microarchitectural timing signals. Hardware-rooted attestation also means that any compromise of the CPU or GPU vendor's signing infrastructure — however unlikely — could undermine the entire chain of trust.

What Comes Next for Confidential AI in the Enterprise

The Opaque acquihire converts Anthropic from a consumer of confidential-computing infrastructure into an organization with the staff and IP to build it natively into Claude's platform. The practical outcome that matters most for enterprise buyers is whether a Claude API endpoint with hardware TEE guarantees and TRACE attestation export ships before or after competing platforms replicate the same capability using the now-openly-governed TRACE standard. Anthropic's IPO roadshow begins in three weeks; the company's enterprise revenue story will be told to institutional investors with or without a production confidential-computing integration live in Claude. The question is whether the Opaque team that just arrived at Anthropic has enough runway to ship something deployable before that story hardens into a valuation.