The company being acquired announced the deal first. Opaque Systems, a confidential computing startup spun out of a Berkeley research lab, posted a farewell note on its website on October 13 saying its team was joining Anthropic and that the company was winding down. The acquiring party confirmed the arrangement six days later, on October 19, without disclosing terms.
What Anthropic bought is a specific capability rather than a product line. Opaque’s software runs AI workloads inside hardware-protected enclaves, sealed areas of a processor where data stays encrypted even while a model is reading it. The technique is called confidential computing, and it addresses the objection that stops most regulated customers from putting patient records or trading data into a cloud service: that the operator of the servers, and anyone who compromises them, can see everything.
The company began as a research project at UC Berkeley’s RISELab a decade ago, built by a group that included Raluca Ada Popa, a professor of computer science, and Ion Stoica, who co-founded Databricks and Conviva. Rishabh Poddar, who wrote his dissertation in that lab, served as chief executive and later chief technology officer. Opaque raised a 22 million dollar Series A in 2022 led by Walden Catalyst, with Intel Capital, Storm Ventures, Thomvest and Race Capital participating.
Anthropic said it was bringing over the chief executive and the chief technology officer along with the engineering team, and that the technology would be folded into its enterprise products. Neither company said what happens to the platform Opaque’s existing customers run on. Opaque’s own note pointed to a set of open-source projects, including TRACE and a specification called Confidential MCP, that will continue under a separate organization, and to a conference that now lives at the Linux Foundation. Support contracts are a different question, and nobody has answered it publicly.
That gap is normal in deals of this shape and still worth naming. When a security vendor is absorbed by a much larger buyer, the customers who bought the product because it was independent have to decide whether the same assurances survive the change of ownership. Opaque’s pitch was that trust should be verifiable rather than promised. Verifying a vendor’s continuity is harder.
The strategic logic on Anthropic’s side is not complicated. The company sells Claude to banks, hospital systems, insurers and government agencies, and every one of those buyers asks the same question in the security review: what can you see, and how do I know. A hardware enclave gives a technical answer instead of a contractual one, and a technical answer shortens procurement. Anthropic has spent the past two years building an enterprise sales organization to compete with OpenAI and Google, and the deals it loses are often lost in the compliance queue rather than on model quality.
The agent problem sharpens the case. A chatbot that reads a document is a contained risk.
An agent that can query a database, send mail and initiate a payment is a system with reach, and the damage it can do grows with the permissions it is given. Opaque spent its last two years moving from protecting data toward proving what a model did with it, producing cryptographic evidence of which code ran and under which policy. Anthropic’s own security researchers have written about the same problem from the other direction, arguing that agents should be treated as internal threats with narrowed permissions and logged tool calls.
Confidential computing has a long record of arriving late. Performance overhead, the difficulty of attesting to a remote machine and the absence of tooling kept adoption inside a narrow set of financial and healthcare deployments. Cloud providers built offerings anyway, and Nvidia added protected modes to its data center GPUs, which is what made the approach practical for model inference rather than only for databases.
Apple changed the public argument in June, when it described a private computing system that processes requests on servers it does not fully control and publishes the software for outsiders to inspect. The point was not that Apple invented the technique. It was that verifiable privacy could work at the scale of a billion devices without a visible cost to the user. Opaque’s farewell post cited that example directly, and it is the strongest argument the category has had.
For Anthropic, the acquisition is small in dollars and large in positioning. The company is preparing a listing, and the story it tells investors is about enterprise revenue rather than consumer usage. A capability that lets a hospital run Claude on records it would never hand to a vendor supports that story more cheaply than hiring the same engineers would cost. Buying a team that has already built the thing is the standard move in AI right now.
The risk sits in the ordinary places. Absorbed security teams often lose their independence, and a feature that exists to satisfy an auditor can quietly become a checkbox on a slide. Anthropic’s engineers will now be both the vendor and the attestor, which is exactly the arrangement confidential computing was designed to distrust.
The technology also solves a narrower problem than the marketing implies. An enclave protects data while it is being processed. It does not fix a bad consent form, an unpatched application or a clinician who exports a spreadsheet.
Anthropic has bought a stronger lock. Whether the doors behind it are worth locking is still a question for its customers.
Opaque’s customers will find out over the next two quarters, when renewal dates arrive and the account manager has a new employer. The company’s researchers will find out sooner. They spent ten years arguing that trust should be provable, and they now work for a company whose valuation depends on people trusting it.
