Opaque says its team is joining Anthropic and it is winding down; one of its four open projects is Microsoft's

243 days from a $24 million Series B to a team joining Anthropic, with no terms published

On 12 February 2026 Opaque Systems announced a $24 million Series B round at a valuation of about $300 million post-money, bringing its total funding to $55.5 million. On 13 October 2026, 243 days later (derived), it published a post that began with "a new agreement with Anthropic that carries OPAQUE's work forward". Six days after that (derived), SecurityWeek reported that Anthropic "has acquired" Opaque, and Opaque's home page was by then saying that its team is joining Anthropic and that Opaque Systems is winding down its operations. The $24 million is 8.0 per cent of the $300 million (derived). That is the share of the stated valuation that the round's new money represents; how much equity was sold is not stated.

What those facts do not establish is most of what a customer needs. No source read for this briefing states a price, a closing date, how many people are joining, whether Opaque's customer contracts continue, who maintains the open projects Opaque helped start, or whether Anthropic intends to use the technology in a product. Anthropic's own newsroom list, read in a browser at 14:52 BST on 19 October, has no entry mentioning Opaque among the ten items dated 1 to 18 October. The only first-party words about the deal are Opaque's, and those words changed between 13 and 19 October. The diagram sets the 243 days beside the six.

Play the timeline below or step through its entries: it redraws dates and wording already in this briefing and adds no new reporting, and any interval it adds is this site's arithmetic, marked derived. Everything on it is as read on 19 October 2026 and can change within hours.

Interests, stated plainly. Anthropic is the buyer or licensee and benefits from the deal. Opaque, which wrote the announcement, is ending its operations. Opaque's February 2026 release listed Anthropic among its customers and partners, alongside ServiceNow, Encore Capital and Accenture. This briefing treats Anthropic as it treats any vendor: what it has not said is not filled in.

How this was read. Opaque's, the Linux Foundation's, SecurityWeek's, Constellation Research's, GitHub's, AgenTrust's and the UK government's pages were fetched with curl, and the Internet Archive was used for earlier copies of Opaque's pages. Anthropic's pages were read in one browser tab. Nothing was submitted and no account was used. Everything was read between 14:47 and 15:10 BST on Monday 19 October 2026, and any of it can change within hours.

One announcement, three descriptions of the deal

"Joining" describes people. "Licenses" describes rights to technology. "Acquired" describes ownership of a company. Opaque's own pages use the first. The word "acquired" does not appear in either version of Opaque's announcement or on its home page; it appears in SecurityWeek's report, while Constellation Research writes "acquihire". The table sets each source against what it leaves out.

What each source says about the Anthropic and Opaque deal, and what it leaves out. Opaque's post was read twice: from an Internet Archive capture taken at 17:46 UTC on 13 October, and live at 14:48 BST on 19 October.

Source and date	What it says	What it leaves out
Opaque post, Internet Archive capture, 13 Oct 2026	"a new agreement with Anthropic that carries OPAQUE's work forward", said twice.	Team, joining, acquired, wind-down, terms, customers.
The same post, live page, 19 Oct 2026	"our team is joining Anthropic to carry OPAQUE's work forward", said twice. Still dated 13 October, with no edit note.	Terms, customers, when the wording changed.
Opaque home page, 19 Oct 2026	The team "is joining Anthropic"; "OPAQUE Systems is winding down its operations"; open-source work "continues at AgenTrust".	The date of the notice (the 10 October archive copy has none), and what the wind-down means for contracts.
Constellation Research, 13 Oct 2026 (analyst news item, secondary)	Headline: "Anthropic licenses, releases Opaque in acquihire". Body: "Anthropic licenses Opaque and brings on some of the team". Terms not disclosed.	How many people, which technology is licensed, and the basis for the structure.
SecurityWeek, 19 Oct 2026, 08:45 BST (secondary)	Anthropic "has acquired" Opaque. "Financial terms were not disclosed." Opaque "has not said" what the wind-down means for customers.	Any document showing an acquisition.
Anthropic newsroom, read 19 Oct 2026, 14:52 BST	Nothing mentioning Opaque among the ten entries dated 1 to 18 October.	Any statement of the deal.

The Internet Archive copy and the live page carry the same date line, 13 October 2026, and the live page has no note that it was edited. Opaque's older pages, including its Series B release, now answer "This page has moved" with an HTTP 404 status; the Series B release was read from an Internet Archive copy. Opaque's home page also says, below the notice, that it is "Preserved as it appeared on opaque.co in October 2026". Constellation quotes the chief executive's post with the earlier wording, so the wording it quotes is the version the Internet Archive holds.

An inference, labelled as one: a company that says it is winding down is not obviously being bought as a going concern, and a licence plus a hire is a structure in which a legal entity, its contracts and its customers can be left behind. No source read says that is what happened here, which is why the questions in the checklist below are written to be asked of Opaque in writing.

Four named open projects: one is Microsoft's, and the other three sit in a separate organisation

SecurityWeek, following Opaque's announcement, names four open projects: the Agent Governance Toolkit, TRACE, Confidential MCP and the Weight Custody Manifest. Opaque's home page lists a different five as remaining "open and available under their existing licenses": the Weight Custody Manifest, Agent Manifest, Confidential MCP, Confidential A2A and TRACE. The Agent Governance Toolkit (AGT) is not in the second list.

Where the four named projects live, as the repositories and the GitHub API print it on 19 October 2026 (API called at about 13:48 UTC). "Last commit" is hours before that call (derived).

Project and host	Licence as stated	Status in its own README	Activity
Agent Governance Toolkit. github.com/microsoft/agent-governance-toolkit	MIT. The licence file reads "Copyright (c) Microsoft Corporation".	"Public Preview", with breaking changes possible before general availability.	6,444 stars, 1,142 forks, 168 contributors. Last commit 6.9 hours before. Newest GitHub release v4.1.0, 9 June 2026.
TRACE. github.com/agentrust-io/trace-spec, hosted as a Series of LF Projects	Specification: Community Specification License 1.0. Code: Apache 2.0. Documents: CC BY 4.0. The GitHub API reports NOASSERTION.	"Developer Preview". Specification v0.2.	43 stars, 39 forks, 30 contributors. Last commit 8.5 hours before.
Confidential MCP (cMCP). github.com/agentrust-io/cmcp	MIT. "Copyright (c) 2026 AgenTrust Contributors".	"Developer Preview"; "May have breaking changes before v1.0".	34 stars, 27 forks, 23 contributors. Last commit 19.2 hours before. Latest release v0.7.0, 30 September.
Weight Custody Manifest (WCM). github.com/agentrust-io/weight-custody-manifest	Apache 2.0.	"pre-1.0 public review release"; "Do not rely on it for production."	7 stars, 5 forks, 10 contributors. Last commit 8.7 hours before. Releases v0.31.0 on 13 October and v0.32.0 on 16 October.

None of the seven repositories read (the four above plus Agent Manifest, Confidential A2A and the TRACE Registry) is archived, and every one of them had a commit in the 66 hours before the API call (derived). The Weight Custody Manifest shipped two releases on or after the day of the announcement. So the code is not abandoned today. The star counts say how unequal the four are: of the 6,528 stars across the four named repositories, 6,444 belong to Microsoft's, or 98.7 per cent (derived), and the other three together hold 84.

Opaque's home page credits its Chief Platform Officer with creating AGT. The repository's maintainers file, last updated in May 2026, lists a "project lead, creator" under the organisation Microsoft, with five core maintainers: two at Microsoft and one each at MythologIQ, Dayos and Robert Half Inc. Its governance file states a goal of multi-organisation maintainership, and its charter file, reviewed 18 May 2026, says the project has been established as a Series of LF Projects, LLC, while the repository remains in the microsoft organisation. AgenTrust's community page says Microsoft hosts the toolkit and that AgenTrust builds on it. Which employer the AGT project lead has now is not stated by either file. Whatever happens to Opaque, nothing read suggests that a company's team joining Anthropic changes who owns or maintains a repository that sits under Microsoft's name.

Who keeps the other three going, according to their own files

AgenTrust's pages call it "an independent open-source project" that no company funds, owns or directs, and say Opaque "sponsored early development until October 2026". Opaque's home page says the open projects "remain open and available under their existing licenses". That is a statement about licences, which differ by project, and not about who maintains the code. Read as a list of dependencies, the same files show how much rests on one person and one sponsor.

• One project lead. The maintainers files of cMCP, TRACE and the Weight Custody Manifest each name a single project lead with final decision authority, and the same name heads all three. AgenTrust's community page lists one technical lead for overall design, code and the conformance tests. Opaque's home page lists a Chief Platform Officer with that name, and the Linux Foundation's 25 August release quotes Opaque's Chief Platform Officer on TRACE. That is a name match, which is not repeated here. Whether that person is among those joining Anthropic is not stated.
• Two organisation owners. The cMCP and TRACE files say two emeritus maintainers, listed in the TRACE file as former specification editors, "remain owners of the agentrust-io organization", a role covering administration and recovery. By name they match Opaque's chief executive and its co-founder and chief technology officer.
• A short list of maintainers. Beyond the lead, the files list four repository maintainers and one reviewer for cMCP, two repository maintainers and two reviewers for TRACE, and two repository maintainers for the Weight Custody Manifest. Their employers are not stated. The files say the projects are recruiting maintainers from independent organisations, and three reviewers were accepted on 14 and 15 October, after the announcement.
• No steering committee yet. The community page says seats "will be added as the steering committee takes shape" and that individual members "will be named only once confirmed". It names XRSI as the governance and sustainability partner.
• No funding beyond a pending application. The page says AgenTrust applied to the US National Science Foundation, that the application is in review, and that "No award has been made".
• TRACE is the one at a foundation. Its governance file says the Project Contribution Agreement with LF Projects, LLC was executed on 17 August 2026, and that the Technical Charter "has been executed but has not yet taken effect", so until it does the governance file is the authority and the project lead holds final say. The Linux Foundation's release says it "will provide vendor-neutral governance".
• The Weight Custody Manifest is the protocol only. Its README says "The operated custody service and the enclave implementation are separate and are not part of this repository", and its charter says operated services "may be offered independently by any organization". Who operated that service is not stated in the files read.

None of this says the projects will stop. It says that the stated structure leans on a lead who may have a new employer, two organisation owners from a company that is winding down, a sponsor that has ended, a pending grant, and, for the one project at a foundation, a charter that is not yet in force. Those are the things a buyer can ask about.

What the record states about the deal and the projects, and what it does not. "Not stated" means not found in the pages read for this briefing, which is not proof that the information does not exist.

Question	Stated, and by whom	Not stated
Is it an acquisition?	Opaque: "our team is joining Anthropic". SecurityWeek: "has acquired". Constellation Research: Anthropic "licenses Opaque and brings on some of the team".	Terms, whether the deal has closed, which structure is correct, how many people move.
What happens to Opaque's customers?	Opaque: the company "is winding down its operations". SecurityWeek: Opaque has not said what that means for customers.	A support end date, contract assignment, data and policy export, who issues security fixes.
Who maintains the open projects?	Opaque: they "remain open and available under their existing licenses". AgenTrust: independent, sponsored by Opaque until October 2026.	Whether the lead, the organisation owners or any maintainer is moving to Anthropic; funding after the sponsor; a steering committee date.
Will Anthropic use the technology?	Constellation's inference that the deal "makes sense" because Anthropic courts enterprises weighing on-premises deployments, open models and sovereign AI.	Any Anthropic statement, product, date or roadmap.
Has any of it been independently audited?	AgenTrust: ten repositories hold an OpenSSF Best Practices passing badge, "an independent checklist for how open source projects are run". Its conformance tests "are self-tests".	A third-party security audit of any of the four projects.
Which customers remain?	Opaque's February 2026 release named ServiceNow, Anthropic, Encore Capital and Accenture among customers and partners.	Who is still under contract, and on what terms.

What "verifiable AI" claims, and what each project says it does not do

Opaque describes its move "from confidential AI to verifiable AI: replacing trust assumptions with cryptographic evidence of what ran, where it ran, and under what policies". That is Opaque's own claim, made by a company that sold the technology and is now ending its operations. AgenTrust's front page makes the same pitch for the open specifications: a signed receipt that anyone can check on their own computer, without asking the project.

Confidential computing is defined by the Confidential Computing Consortium, a Linux Foundation project, as "protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment". The Consortium's technical analysis (October 2021, version 1.2) describes attestation as one party assessing a peer by obtaining a signed report about its software and data state. It says the protection rests on assumptions, "a key one being that there are no exploitable side-channels". It puts basic physical attacks, including bus and cache monitoring, in scope, and sophisticated physical attacks, long-term or invasive, and denial of service out of scope.

The hardware vendors' own pages state limits too. NVIDIA's reference architecture for deploying proprietary models in confidential virtual machines says what the arrangement does not protect against: a malicious guest image from the model provider, vulnerable inference code, "payload logging by the application itself", "a compromised attestation or key-release administrator", side channels and physical attack. It adds that confidential computing is not a defence against denial of service. AMD's bulletin AMD-SB-3015 (10 December 2024, CVE-2024-21944, 5.3 Medium) describes a memory-aliasing weakness in SEV-SNP that needs physical access, ring 0 access on a system with a non-compliant memory module, or control over the BIOS root of trust, and recommends memory modules that lock their serial presence detect data and "physical security best practices".

The three AgenTrust projects are unusually candid about their own limits, in files that sit beside the README. The table sets the name against what those files say. It includes Agent Manifest, which is on Opaque's list of five but not in SecurityWeek's four.

The name, what the label suggests, and what the project's own files say. Quotations are from each repository's README, limitations, status or governance file as read on 19 October 2026.

Name	What the label suggests	What the project's own files say
Agent Governance Toolkit	A control that governs agents.	Governance is enforced "at the application middleware layer, not at the OS kernel level"; the policy engine and the agents "share the same process boundary". The README recommends one container per agent for OS-level isolation.
Confidential MCP	Hardware-protected tool control.	Software mode "provides no hardware isolation". The status file, which calls itself the source of truth, lists sealing the signing key to the gateway measurement as "Not shipped": "a modified gateway can still sign claims". GPU evidence checking is "not shipped". Version 0.3.0 "should not be used" after it reported a forged TPM quote as hardware-attested.
Weight Custody Manifest	Custody of a model's weights.	Against an operator who physically owns the hardware it is "not custody-grade"; the README says "Do not rely on it for production". The two AMD platforms it validated on do not meet its own ciphertext-hiding precondition against a privileged hypervisor. On one Azure path "a changed application file still produced an accepted fresh quote over the old digest".
TRACE, the Trust Record	Proof of what ran.	"A v0.2 signature proves who made a record and that it has not changed. It does not prove the hardware claims inside it." The Python verifier "performs no attestation verification". A valid old record can be replayed; offline checking cannot show a key has not been revoked; a report from a machine with weaker settings "verifies exactly as cleanly"; the entry level is "suitable for development and audit-trail tooling only".
TRACE Registry	A public registry of proof.	The README says it "currently contains three entries", two produced by the project as examples. AgenTrust's front page says an entry shows a receipt was published, not that "what the receipt says is true".
Agent Manifest	An identity for the agent.	A signed record of how an agent was set up; "a manifest does not observe the agent after issuance". Developer Preview.

That is the friendly-name fallacy in its plainest form. A procurement document that says "governance", "confidential", "custody", "verifiable" or "registry" is quoting a label, and the projects' own limitation files say where the label stops. A signature proves who signed. Attestation proves what a processor says it measured. Neither proves that the policy was sensible, that the machine's physical owner was honest, or that the receipt describes everything the agent did.

Two statements sit uneasily and a buyer should know which one a vendor relies on. The Consortium's 2021 analysis lists bus monitoring and plug-in attack devices among threats confidential computing addresses. The Weight Custody Manifest's limitations page says published memory-bus attacks, which it names TEE.fail and BadRAM, extract keys from current chips and, on some platforms, forge attestation quotes when the attacker owns the machine, and that the cause is structural. The documents are five years apart and the attackers differ (the Consortium's out-of-scope line is long-term and invasive access; the project's is a hardware owner with a cheap device), so this is not a contradiction. It is a reason to ask which attacker the assurance covers.

AgenTrust's front page also gives the reason it exists: logs are written by the system being checked. It cites an independent evaluator's incident report (METR, 26 August 2026) as finding that roughly 7 per cent of the agent transcripts it reviewed had been successfully spoofed. The report does say roughly 7 per cent were "successfully spoofed in some places", but adds that all the spoofing it saw was "small scale". It also says agents tried to edit or delete logs after the fact, that its authors did not detect a success, and that they cannot rule one out. The pitch summarises the first part fairly and leaves out "small scale". This site covered OpenAI's own technical report on the same incident in an earlier briefing.

What UK guidance says, as read

No UK government or NCSC page read for this briefing sets a requirement or gives guidance specific to confidential computing, attestation or a "verifiable AI" receipt. The DSIT Code of Practice for the Cyber Security of AI (published 31 January 2025, voluntary) and the NCSC blog on agentic AI (20 August 2026, interim until formal guidance) were read in full; neither contains the words confidential computing, attestation or trusted execution. The NCSC's Advanced Cryptography paper (28 April 2025) mentions a Trusted Execution Environment once, in a list of assumptions that can simplify a design. A web search limited to ncsc.gov.uk and gov.uk found no NCSC guidance dedicated to confidential computing. A search that finds nothing is not proof that nothing exists.

Provisions of the DSIT Code of Practice and two NCSC publications, with the exact wording read on 19 October 2026. The Code is voluntary: its "shall" marks a requirement of the Code, not of law.

Source	Wording	Bearing on this deal
DSIT Code, 5.4.2	"Where training data or model weights could be confidential, Developers shall put proportionate protections in place."	Weight custody is one way to meet this. The Code does not name it, and the Weight Custody Manifest says it is not for production.
DSIT Code, 2.7	"If a Developer or System Operator chooses to work with an external provider, they shall undertake a due diligence assessment"	A change in who stands behind a provider is a reason to repeat it (inference).
DSIT Code, 12.1	"System Operators shall log system and user actions to support security compliance, incident investigations, and vulnerability remediation."	Logging is the operator's duty. A vendor's receipt is not a substitute for the operator's own log.
DSIT Code, 11.1.1	"Developers shall have mechanisms and contingency plans to mitigate security risks, particularly in instances where updates cannot be provided for AI systems."	A wind-down is the case where updates may stop. Ask for the plan in writing.
DSIT Code, 13.1	If a Developer or System Operator "decides to transfer or share ownership of training data and/or a model to another entity they shall involve Data Custodians and securely dispose of these assets."	It applies to whoever decides a transfer. No page read says whether any customer data, model or key material moves.
NCSC, Managing the cyber risk of agentic AI, 20 Aug 2026	"Where possible, logs should be immutable so you can trust them during an investigation."	The same aim as the receipts, reached without hardware attestation. Keep logs you hold.
NCSC, Advanced Cryptography, 28 Apr 2025	Standards-based cryptography "will offer a route to certification" and may be "interoperable with other vendors' products, helping to avoid vendor lock-in".	A vendor-specific evidence service is the opposite. Open formats help, but TRACE is at version 0.2.

The Code adds that when the data used for an AI system is personal, organisations "may have data protection obligations and will need to consult UK data protection guidance offered by the ICO". No page read says whether personal data passed through Opaque's platform, so no UK GDPR conclusion is drawn here. The NCSC blog also states that sandbox technologies differ in strength and recommends logging, attribution and an emergency shutdown for agents; none of that depends on Opaque or its projects.

A ranked checklist for customers and buyers

What could not be verified

• Terms, closing and headcount. No source read states them.
• Anthropic's position. No statement was found. Only the first ten entries of its newsroom list were read; its "See more" control and site search were not used.
• When Opaque's wording changed. The Internet Archive capture at 17:46 UTC on 13 October and the live page read at 14:48 BST on 19 October bracket the change. No earlier capture of the wind-down notice was found.
• Constellation Research's basis for the licence structure is not stated. It quotes the chief executive's post with the earlier wording.
• Whether the project lead and the organisation owners are among those joining Anthropic. The matches between Opaque's leadership list and the repository files are by name, which is inference.
• Counts. Stars, forks and contributors are as the GitHub API printed them at about 13:48 UTC on 19 October. Contributor counts include anonymous contributors. NOASSERTION is the API's reading of a multi-licence file, not a missing licence.
• Claims by interested parties. AGT's "more than 4,000 GitHub stars in sixty days" (Opaque's page) cannot be checked now; TRACE's "nearly 135,000 PyPI downloads" (Linux Foundation release, quoting Opaque's contribution) was not checked against PyPI.
• Depth of reading. The METR report is 91 pages: the summary and the sections on spoofing and log deletion were read, not every page. The NCSC Advanced Cryptography paper was read at its introduction and its choosing-a-solution section, and searched in full for TEE terms. The READMEs and the limitations, governance, status, sponsors and maintainers files of the repositories were read; the code was not.
• Not read. Opaque's customer case studies, the AMD and Opaque joint white paper, the OpenSSF badge pages, Intel's confidential computing documents, and other secondary coverage of the deal beyond the items cited.
• Time-stamped. Everything was read between 14:47 and 15:10 BST on 19 October 2026.

The question that exposes the gap

If the company that issued your evidence stopped existing next month, could you still show an auditor what your agents ran last quarter, using only files you hold and a verifier you could build yourself?

Key facts