Anthropic Licenses Opaque Systems Tech and Hires Its CEO: What the Deal Is and Is Not

Anthropic has agreed to license technology from Opaque Systems, a confidential-AI startup, and hire part of its team; one aggregator reports that includes CEO Aaron Fulkerson, which we could not confirm elsewhere. Several aggregator headlines call it a "$300M" deal. That number is Opaque's valuation from its February Series B, not a disclosed price. Constellation Research, which broke the details, says the terms were not disclosed. This post explains what Opaque built, why a lab like Anthropic would want it, and what remains unknown. For Anthropic's other enterprise moves, see our coverage of the Claude marketplace expansion and the Accenture embedded evaluation.

Quick reference

What Opaque built

Opaque began about a decade ago as a UC Berkeley RISELab project and grew into a company selling a confidential AI platform. The idea targets a gap in ordinary encryption. Data is encrypted at rest and in transit, but it has to be decrypted in memory to be processed, which is where operators, cloud admins or malware could see it. Confidential computing runs the workload inside a hardware-sealed environment, and attestation lets an outside party verify that the right code, and only that code, ran on the data.

In February 2026, Opaque raised a $24M Series B at a roughly $300M valuation, bringing total funding to $55.5M, per SiliconANGLE and Intel Capital's announcement. The company named Nvidia, AMD, Intel and hyperscalers as ecosystem partners, and ServiceNow, Accenture and Anthropic among customers and endorsers. So Anthropic was already a customer before this agreement.

Locked box with gears turning inside, illustrating confidential AI keeping data protected while it is processed

Why Anthropic would want it: its own confidential inference research

This deal builds on work Anthropic has published. In June 2025, Anthropic and Pattern Labs described confidential inference via trusted VMs, a design where sensitive data stays encrypted except while being processed. In that design:

• A small trusted "model loader and invoker" runs in an isolated virtual machine, and only it can see decrypted data.
• The rest of the inference server is treated as untrusted.
• The loader accepts only code signed by a CI server that needs multi-engineer review.
• A key server releases decryption keys only after attestation proves the environment is configured correctly.

Anthropic was candid about the gaps. Hardware-based memory protection for shared accelerators was not yet well established, so it relied on compute providers for physical and hypervisor security, and it urged chip designers to build confidential computing into accelerators. It described the work as early research. Opaque's platform is an already-productized version of the same family of ideas, with cryptographic proof of each run, which is why the fit looks natural.

What the deal likely signals

Be careful here. The following is analysis, not reporting.

1. Regulated industries. The aggregated reporting frames the technology as a way to deploy AI in hospitals and banks, where data handling must be provable. Anthropic's recent finance push, such as Claude for financial advisors, runs into exactly those requirements.
2. On-premise and sovereign deployments. Constellation ties the deal to enterprises weighing on-prem, open models and sovereign AI architectures. If you want a primer on that trend, read what sovereign AI means.
3. Weight protection. The 2025 research listed securing model weights against capable attackers as a goal. Attested environments also help there.
4. Security absorbed by the lab. One reading is that model providers are pulling the security layer in-house instead of leaving it to partners. That is our opinion, not reported fact.

Acquihire, license, acquisition: why the label matters

Three words get used interchangeably in headlines, and they mean different things for customers and employees.

Constellation Research uses the acquihire label and notes a license; some outlets say "acquire." The structure described is a license and hiring, which is the third row. That matters because it may leave Opaque free to keep serving customers, or to wind down, and the reporting does not say which. Similar structures have become common this year, as in the talks we covered in Nvidia and Reflection AI, where the people and the licensed technology are the point.

How attested inference works, step by step

Readers often ask what "cryptographic evidence of every run" actually means. A simplified flow, consistent with Anthropic's 2025 design and with how confidential computing is generally built:

1. Seal. The workload starts inside a hardware-isolated environment, such as a confidential virtual machine, whose memory the host cannot read.
2. Measure. The hardware records a fingerprint of what booted: firmware, operating system and the loader code.
3. Attest. The environment presents that signed fingerprint to a key service, which compares it to an allow-list.
4. Release keys. Only if the fingerprint matches does the key service release the decryption keys for the data or model weights.
5. Run and log. The job runs, and a signed record ties the result to the verified environment.

The practical payoff is an audit trail. A hospital or bank can show a regulator not just a policy document but a verifiable record that its data was only processed by approved code. The limit, which Anthropic itself named, is that protections for GPUs and other accelerators lag behind those for CPUs, so the strength of the guarantee depends on the hardware generation and the cloud provider.

Questions readers are asking

Does this make Claude safe for patient or bank data today?

There is no announcement of a changed product. Existing enterprise controls still apply, and any claim that this deal has already made Claude "provably private" would be ahead of the evidence. Ask Anthropic for written terms before moving regulated data.

Is Anthropic competing with the cloud providers here?

Not directly. Confidential computing hardware comes from Nvidia, AMD and Intel and is exposed by clouds. Opaque's value was the layer on top, which makes it practical to run analytics and AI jobs with attestation. Anthropic gaining that layer in-house could reduce its dependence on partners for the trust story.

Why would a startup with a $300M valuation do a license deal?

We do not know. Reported terms are undisclosed, and valuation is not proof of revenue or of a sale price. Licensing and hiring can be attractive when a buyer wants a team and technology without the full liabilities of a company. Treat any motive as speculation until Opaque or Anthropic says more.

What is claimed and what is verified

Confirmed by Constellation and SiliconANGLE: a license plus hiring; no disclosed terms; Opaque's prior $24M Series B at about $300M valuation. Reported only by an aggregator: Fulkerson and Poddar joining; Opaque's customer and partner list.

Quoted from Opaque's CEO: Fulkerson wrote that the company is "proud to share a new agreement with Anthropic that carries OPAQUE's work forward," as quoted by Constellation. We could not load Opaque's own post, so we cite it through that outlet.

Not confirmed:

• Any dollar figure for the deal.
• The number of employees joining. Constellation does not give it.
• Which Opaque technology is licensed, and whether it is exclusive.
• Whether Opaque continues to operate and serve ServiceNow, Accenture and others.
• A product timeline, or any regulatory or customer adoption.

If you see "$300M" in a headline, treat it as the valuation. Nothing we found says Anthropic paid that.

What this means for people who build or buy

• If you are a regulated enterprise, the near-term change is nil. Nothing has shipped. But expect Anthropic to talk about attestable processing in sales conversations, and ask for specifics: which hardware, which attestation, who holds the keys.
• If you use Opaque directly, ask your account team about continuity and data-processing terms now, since the future of the standalone product is unclear.
• If you build agents on Claude, note the broader security theme. Anthropic's cyber work, such as the critical infrastructure defense program and the cyber verification tiers, points the same direction: trust that can be proven, not just promised.
• Treat provable privacy as a checklist, not a badge. Ask what the trusted boundary is, what is attested, and what happens at the accelerator, which Anthropic itself flagged as the weak spot.

How to track this

• Watch Anthropic's newsroom and Opaque's blog for a joint statement with specifics.
• Look for product or documentation changes mentioning confidential or attested inference on Claude.
• Compare any later numbers with the sources above; correct the $300M framing whenever you see it.

We will add an update if terms or product plans are published.

Related reading

• Anthropic Claude marketplace expansion
• Anthropic and Accenture embedded evaluation
• Claude for financial advisors
• What is sovereign AI?
• Anthropic cyber defense program for critical infrastructure
• Anthropic cyber verification program tiers
• Nvidia and Reflection AI acquihire talks

Details are accurate as of October 14, 2026 and rest on secondary reporting; terms were undisclosed at the time of writing.