The prompt stops at your own server now

Picture a Friday afternoon. A payments engineer has a Claude Code terminal open, chasing a production incident that the logs refuse to explain. So she does the thing everyone does: she pulls a handful of failed transactions straight out of the database and pastes them in. Customer names, email addresses, the first six digits of card numbers, and the internal error codes from the company's payment gateway, all in one blob. Enter.

Until this year, that was the end of the story. The data left the building. Security found out the following week during a log review, if they found out at all, and the only thing left to do was write a post-mortem and add another slide to the training deck.

Here's the deal: that request now reaches Anthropic's servers and then does not go to the model. Instead a signed HTTPS POST fires off to an endpoint the company itself operates, carrying the full conversation transcript. If that server answers within the timeout — five seconds by default — with something like {"action": "deny", "deny_reason": "This prompt appears to contain customer payment card data, which your organization's policy does not allow."}, Claude never sees a word of it. The engineer gets a blocked-by-policy message with the reason and a contact, and the refusal lands in the organization's Activity Feed as an inference_hooks_request_denied event.

Anthropic shipped this on August 5, 2026 and called it Inference hooks. It's in beta for Claude Enterprise organizations. The docs describe it plainly: send each governed prompt to your organization's AI security server for an allow or deny verdict before inference proceeds.

Why now becomes obvious once you look at the exposure numbers. Check Point's AI Security Report 2026 found that somewhere between 87% and 93% of organizations hit at least one high-risk generative-AI interaction every month, and that the share of prompts carrying sensitive corporate, personal or regulated data doubled in a year to one in every 25. One in twenty-five. If a team fires 200 prompts a day, eight of them contain something that shouldn't be leaving. And until now there was no clean place to stand and catch them.

Why Anthropic built the checkpoint itself

Start with the company. Anthropic was founded in 2021 by a group of OpenAI alumni, and in 2026 it has arguably the steepest revenue curve in the industry. Reporting puts its annualized run-rate at roughly $9 billion at the end of 2025 and around $47 billion by May 2026, with more than 300,000 business customers and over 1,000 accounts spending north of $1 million a year. None of those are audited figures the company has filed anywhere, so read them as orders of magnitude rather than precision. The direction, though, isn't in dispute: the overwhelming majority of Anthropic's revenue comes from enterprises.

And that enterprise revenue now flows through three widening doors. There's claude.ai on web and desktop. There's Claude Code running in a terminal. And there's Claude Cowork, which arrived as a research preview at the end of January and went generally available in early April with a stack of enterprise machinery bolted on — role-based access controls, group spend limits, usage analytics, expanded OpenTelemetry support, per-connector controls — alongside the launch of Claude Managed Agents on the same day. Anthropic has spent the last six months adding surfaces where employees touch Claude.

More surfaces means more holes, if you're the person responsible for the holes. A browser extension watching a chat box does nothing for a CLI. An endpoint agent installed on managed laptops does nothing on a personal device or a remote session. Which is why the single most important sentence in this launch is about geography, not features. From the docs: because the hook runs on Anthropic's servers, after the request leaves the client and before the model runs, it applies to every governed request uniformly, with nothing to install or deploy on user devices.

That's a declaration that the control point is moving. Enterprise AI security products have so far stood in one of two places. Client-side: browser extensions, endpoint DLP agents, TLS-intercepting network proxies. Or after-the-fact: compliance APIs you poll for logs and then audit. Anthropic just opened a third position — inside its own infrastructure, between the client and the model. Nobody outside Anthropic could stand there before.

The customer quote in the announcement lands on exactly that. Andrew Grimmett, VP of Information Security at Bandwidth, the cloud communications company, put it this way: "Inference hooks add a checkpoint to inspect what's flowing to Claude in real time, before anything sensitive leaves our environment." Strictly speaking that phrasing is a little generous — the data has already reached Anthropic's servers; what the company controls is whether it reaches the model. But the sentence a CISO needs for the board isn't a precise network diagram. It's "we hold the last switch."

And Anthropic isn't selling this alone. The announcement names Netskope, Palo Alto Networks, Proofpoint and Zscaler as compatible, plus custom in-house servers. Those four already have DLP policy engines deployed inside large enterprises. So the pitch isn't "buy a new security product," it's "point the scanner you already bought at Claude." That distribution move is half the story here.

Inside the five seconds

The architecture is almost boringly simple, which is exactly why the details matter.

The flow: a user submits a prompt on a governed surface. Anthropic sends an HTTPS POST to the endpoint the organization configured, body carrying the conversation transcript, signed per the Standard Webhooks specification once the organization generates a signing secret. The security server evaluates and responds within the configured verdict timeout. On allow, inference proceeds. On deny, the request is rejected and the user sees a message assembled from the per-request deny_reason your server returned plus a standing note the admins configured about who to contact.

Signing will look familiar to anyone who's shipped webhooks. Three headers — webhook-id, webhook-timestamp, webhook-signature — with an HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw body bytes}, base64-encoded. The docs go out of their way to flag the two bugs that bite everyone. Compute the HMAC over the body exactly as received, before any JSON parsing or re-encoding. And decode the secret — the part after the whsec_ prefix — with a standard base64 decoder, not a URL-safe one, because a URL-safe decoder derives the wrong key bytes whenever the secret contains + or /, which is most of the time. Timestamps more than five minutes off your clock in either direction should be rejected.

The operational contract is where the real character of this feature shows. The verdict timeout is admin-configurable between 1 and 10,000 milliseconds, defaulting to 5,000, and that budget covers the whole exchange: connection, TLS handshake, request, response. Anthropic retries exactly once, after a 100ms delay, and only when the connection attempt itself failed — once your server has responded, the exchange is never retried. Timeouts, non-200 statuses, unparseable or oversized response bodies, and unreachable endpoints are all "webhook failures," and here's the crucial part: a webhook failure never becomes a deny. Instead the organization's failure-handling setting decides — block the request, or let it proceed uninspected.

Sustained failures trip a circuit breaker. Anthropic stops calling the server entirely and failure handling applies to every request. Recovery is not automatic; an admin has to fix the server and then turn "Enforce verdicts" back on. If you've ever put a synchronous inline check in front of production traffic, this design will smell familiar, because it's the Kubernetes admission webhook problem verbatim. Set failurePolicy: Fail and a dead webhook freezes your cluster; set Ignore and your control quietly evaporates. Inference hooks hands the same dilemma to an admin, except what freezes isn't a cluster — it's every employee's access to Claude.

The boundary on what gets sent is drawn carefully. The security server sees what the user sees: transcript text, tool calls and their results, text extracted from attachments, and prior turns. What it never receives: system prompts, tool definitions, Anthropic-internal context, Claude's hidden reasoning, and raw file or image bytes. Content blocks follow the public Messages API model — text, tool_use with tool name and input arguments, tool_result with the tool's output text plus an is_error flag and the matching tool_use_id, and attachment with file name, media type, size in bytes and extracted text.

One nuance worth untangling, because the announcement and the docs read slightly differently. The blog says prompts and tool call responses are inspected. The docs say the only hook event today is prompt, and that response-side enforcement is planned as a later event. Both are true. In an agent loop, every returned tool result triggers a fresh inference request, and that request's transcript already contains the tool_result block. So tool output does get inspected before the model reasons over it. What doesn't exist yet is enforcement on Claude's own output. A confidential document that an MCP connector drags in from your internal wiki can be caught before it reaches the model; what the model then writes back out is not, today, this hook's business.

The docs list four limitations without flinching. First, attachments arrive as metadata and extracted text only, so image-only content — a screenshot of a document, say — is not inspected at all. That's a real hole: photograph the confidential deck and it sails through. Second, verdicts are allow or deny, full stop. There is no rewriting and no redaction, so the classic DLP move of masking a national ID and passing the rest doesn't exist here. Third, Platform organizations using API access are out of scope. Fourth, it doesn't work on Amazon Bedrock or Google Cloud. Add to that: voice mode isn't covered, and ancillary requests like conversation title generation aren't sent.

Then there's the trap that will actually take someone's production down. Transcripts are sent untruncated, up to a 10 MB ceiling. Meanwhile nginx defaults client_max_body_size to 1 MB and Express's express.json() defaults to 100 kB. A rejected body counts as a webhook failure, and if failure handling is set to "allow the request," then the single largest and most dangerous prompt in the organization is precisely the one that reaches the model uninspected. The control fails open exactly where it's needed most. For completeness: Anthropic reads at most 64 KiB of your response body, and requests originate from 160.79.106.0/24 — a range the docs explicitly say you may allowlist but must not treat as a substitute for signature verification, since other Anthropic egress traffic shares it.

Item Detail
Announced August 5, 2026, beta for Claude Enterprise
Coverage claude.ai, Claude Cowork, Claude Code (web, desktop, CLI) — one hook governs all
Not covered Claude Platform (API) orgs, Amazon Bedrock, Google Cloud, voice mode
Transport HTTPS POST, User-Agent: anthropic-dlp/1, Standard Webhooks signature (HMAC-SHA256)
Hook event prompt only today; response-side enforcement planned as a later event
Verdict {"action":"allow"} or {"action":"deny","deny_reason":…,"reference_id":…}
Shown to user deny_reason, max 500 characters, longer values truncated
Audit trail Denials logged as inference_hooks_request_denied with your reference_id
Timeout 1–10,000ms, default 5,000ms (covers connection, TLS, request, response)
Retry Once, after 100ms, only on connection failure; same webhook-id and signature
Failure handling Org chooses: block the request, or allow it uninspected
Circuit breaker Sustained failures stop enforcement; admin must manually re-enable
Payload limits Request up to 10 MB, untruncated / response read up to 64 KiB
What is sent Transcript text, tool calls and results, extracted attachment text, prior turns
What is never sent System prompts, tool definitions, Anthropic-internal context, hidden reasoning, raw bytes
Rollout controls Shadow mode, rollout percentage, role-based exclusions
Permission organization:manage (Admin, Owner, Primary owner)
Source IPs 160.79.106.0/24

The row to stare at is the rollout controls. Shadow mode observes verdicts on live traffic without blocking anything. A rollout percentage inspects a chosen fraction of requests. Exclusions exempt members of chosen roles entirely. The presence of all three tells you Anthropic understands the actual risk here, which is not data leaking — it's an org accidentally switching off AI for its whole workforce on a Tuesday morning. The docs say it outright: enforcement can roll out at your pace, so nobody has to be blocked on day one.

Anthropic also put a comparison table between Inference hooks and its Compliance API directly in the documentation, which is less a marketing artifact than a positioning statement. Extending it one column further:

Inference hooks Compliance API Network / endpoint DLP
When it acts Inline, before inference runs After the fact As traffic exits your network
What it does Allows or denies each governed request Retrieves activity, chats, files, projects, users Inspects, blocks, masks traffic
Direction Anthropic calls your server You call Anthropic's API Entirely inside your infrastructure
CLI and personal devices Uniform, org-wide Visible only after the fact Only where agents or proxies reach
Latency cost A round trip on every governed request None Added at the proxy hop

Who actually wins here

The obvious winner is the security and compliance function, though "the ability to block things" undersells it. What they really gain is evidence and uniformity. Until now, the best a CISO could tell an auditor about AI usage was some version of "we have a policy, we ran training, we retain logs." Now the sentence becomes "every governed request passed through our policy engine, and each denial is recorded with a reference ID in the activity feed." In finance, healthcare and the public sector, where you have to prove the control exists rather than assert it, that's a materially different conversation.

The second winner is Anthropic. This is, transparently, a sales-friction removal feature. The question that stalls enterprise AI procurement more than any other is "can we control what of ours reaches your model," and every vendor's answer so far has been "read our terms and our retention policy." Anthropic's new answer is "we'll hand the policy decision to your server." That's a hard answer to beat in a security review. There's a quieter second-order effect too: once an organization has wired its DLP engine into Inference hooks and run it in production for a quarter, the cost of switching model vendors goes up. Lock-in rarely comes from benchmark scores. It comes from plumbing like this.

Third: the four DLP vendors. For Netskope, Palo Alto Networks, Proofpoint and Zscaler, generative AI was originally a threat to the business model. Traffic kept getting more encrypted, workloads moved out of browsers and into CLIs and IDEs, and the share of activity a proxy could actually see kept shrinking. Now the model provider itself has sent an invitation: we'll do the enforcement inside our perimeter, we'll just ask your engine what it thinks. They pick up visibility into the hardest-to-see segment without building anything new. It is also, unmistakably, a frenemy arrangement — the terms of that invitation are that the partner owns the verdict logic while Anthropic owns the chokepoint.

Fourth: developers, and here's the genuinely interesting part. In building this, Anthropic effectively defined a new job. The docs split the roles explicitly — security and compliance teams enforce data policies inline, and developers build the AI security server that evaluates each request. Then it ships minimal working servers in seven languages (Python, TypeScript, C#, Go, Java, PHP, Ruby), each using only the standard library, each roughly twenty lines that drain the request body and return {"action": "allow"}. The barrier to entry was deliberately floored. The warning next to those samples is the actual lesson: these servers accept every request, including unsigned ones — add signature verification before you enforce.

Now the people who lose, or at least get complicated. Employees first. When this is on, everything you type into Claude gets shipped to a company-run server, in full, regardless of whether it violates anything. The documented use cases say the quiet part out loud: "real-time transcript archival," meaning always return allow and persist every frame as a push-based alternative to polling the Compliance API, and "prompt telemetry," meaning measure how your organization uses Claude at the moment of use. A company that wants to can now stream the complete AI conversation history of its entire workforce into its own storage in real time. That isn't inherently bad — it's how DLP has always worked — but everyone on both sides should be clear that this is surveillance infrastructure as much as it is data protection.

The second cost is latency, and the docs concede it flatly: enforcement adds your AI security server's round trip to every governed request in your organization, so keep the verdict fast and load-test before rolling out broadly. Two hundred extra milliseconds on a chat message is invisible. Two hundred milliseconds on a Claude Code agent loop that fires twenty tool calls is four seconds of pure overhead. And because the full transcript is resent on every request, payloads grow as a session grows, so a scanner that actually reads the content gets slower the longer you work. That's the kind of latency that never shows up in a benchmark and always shows up in complaints.

What Samsung learned by banning, what Microsoft learned by embedding

The industry has already run this movie once. In April 2023, Samsung's Device Solutions division suffered three separate leaks in twenty days: engineers pasted proprietary semiconductor equipment source code, internal test sequences, and the transcript of a confidential business meeting straight into ChatGPT. The response came in May — a ban on ChatGPT and other external generative AI tools on company devices and networks.

The lesson isn't the ban. It's the ban's half-life. Prohibition doesn't stop leakage; it relocates it somewhere you can't see. Block it on the corporate laptop and it moves to a personal phone, and at that moment security loses even the logs. The phrase "shadow AI" entered the vocabulary right around then. Within a couple of years most large enterprises had converged on the same conclusion: you don't ban it, you open a controlled door. Inference hooks is the most recent version of that conclusion.

The second precedent is the arc of CASB and network DLP. The category exploded in the mid-2010s cloud adoption wave — stand up a TLS-intercepting proxy, see everything employees push to Dropbox or Salesforce. It largely worked, and companies like Netskope and Zscaler were built on it. But the model had a structural weakness: certificate pinning, unmanaged devices, and above all traffic that flows over APIs rather than apps. A Claude Code session going out from a terminal is a textbook member of that blind spot. The proxy-era playbook doesn't transfer cleanly into the AI era, which is exactly why those vendors have no reason to refuse Anthropic's invitation.

The third precedent is the success case, and it belongs to Microsoft. Purview DLP for Microsoft 365 Copilot went to preview in November 2025 and general availability at the end of April 2026, giving admins a real-time control that stops Copilot from generating a response when a prompt contains defined sensitive information types. The expansion kept coming: blocking Copilot from using web search when a prompt carries sensitive data reached general availability around July 2026, and a control stopping Copilot from processing externally originated email went to preview in June 2026 with general availability targeted for January 2027. The takeaway is clean — for AI controls, embedding beats bolting on, because the moment just before a prompt enters a model is real estate only the vendor owns.

But study the failure mode in that same case, because it transfers too. The recurring complaint about Purview-style enforcement is accuracy. Tune sensitive-information-type matching too tight and legitimate work gets blocked; tune it loose and the control becomes theater. With Inference hooks the problem is sharper, because there's no masking. In a binary verdict with no partial handling, one false positive equals "you can't do your job right now." Which is why shadow mode isn't a nice-to-have, it's a mandatory phase. Any org that flips straight to enforcement is signing its help desk up for a very bad first week.

Check Point went to the firewall, Zenity went to the agent

At least two other launches attacked the same problem from different angles in the same week. That's not coincidence — it's what a category looks like while it's forming.

Check Point shipped its AI Network Firewall in early August as part of the R82.20 software release, calling it the industry's first. The idea is to inspect prompts, autonomous agent actions and LLM traffic from the firewalls a company already runs, through what Check Point calls its AI Defense Plane. It blocks prompt injection and adversarial inputs inline before they reach the model, discovers which AI apps, agents and tools employees are actually using, and stops sensitive data from leaving the network based on what the prompt is trying to do — with no new infrastructure and no network redesign. The logic is coherent: rather than wiring a hook into every model vendor, inspect the one place all of it has to cross.

The Anthropic approach and the Check Point approach carry exactly opposite tradeoffs. The network layer is vendor-neutral: one policy covers Claude, ChatGPT, Gemini and the agents you built yourself. But it inherits the old holes — encryption, unmanaged devices, anything that never touches the corporate network. Inference hooks has none of those holes and also cannot see one inch beyond Claude Enterprise. No Bedrock, no API organizations, no other model. Realistically, large enterprises will buy both.

Then there's Zenity, which announced a $125 million Series C on August 3 led by Norwest, with SoftBank Vision Fund 2, Qumra Capital, Hitachi Ventures and LG Technology Ventures coming in new and Vertex Ventures, Third Point Ventures, DTCP and Intel Capital returning. Total raised is now roughly $185 million. Zenity looks at agents rather than prompts: it discovers AI agents embedded across an enterprise environment, works out what they're for, and analyzes agent intent before execution so security teams can approve, modify or block actions. Critically, it supports Google Gemini, OpenAI ChatGPT Enterprise, Microsoft Copilot, Anthropic Claude and homegrown agents alike. The more each model vendor closes the loop inside its own surface, the more demand there is for a single pane of glass across all of them.

The fourth angle is Microsoft and OpenAI. Microsoft, as covered, executed the same strategy first with Purview inside Copilot. The difference is ownership: Microsoft keeps the policy engine, while Anthropic handed the verdict to the customer's server. Partly that's because Anthropic doesn't have a DLP product line to defend — which is precisely what let it turn Netskope and Zscaler into distribution instead of competition. A weakness converted into a strategy. OpenAI, meanwhile, offers a compliance platform for ChatGPT Enterprise that, as publicly documented, is closer to log-and-metadata retrieval wired into eDiscovery, DLP and SIEM tooling, with third-party partners surfacing risk in something approaching real time. What isn't visible is a specified, documented inline gate where the vendor pauses inference and waits on a customer server's verdict.

And the last competitive angle is the new attack surface this thing creates. Think about it: the complete Claude conversations of an entire workforce now converge in real time on a single internet-facing HTTPS endpoint the company runs. If that server is compromised, what leaks isn't the DLP policy — it's everything the company has ever asked an AI. That's why the docs hammer signature verification so relentlessly, why they insist the IP allowlist is not a substitute for it, and why they warn that after rotating the signing secret, requests signed with the old one can keep arriving for about a minute, so your server should accept both during the switchover. Building a chokepoint also means building a new single point of failure.

So what actually changes

For developers, two things change immediately. First, if your company turns this on, Claude Code may feel slower, especially in long sessions. The full transcript ships on every request, so the payload grows as context accumulates and your security server's scan time grows with it. If Claude Code mysteriously got sluggish and nothing in your setup changed, it's worth asking infra whether Inference hooks is enabled for your org. Second, if you're the one building that security server, treat the docs' gotcha list as a literal checklist: HMAC over raw bytes, standard base64 for the secret, idempotency keyed on webhook-id, a body limit raised to the 10 MB ceiling, and — most importantly — return allow rather than an error when the top-level type is a value you don't recognize. That last one matters because when Anthropic adds a new event type, a server that errors on it generates webhook failures, and sustained failures trip the circuit breaker. A future feature release can become today's company-wide outage because of how you wrote an else branch.

For enterprise decision-makers, this changes the procurement scorecard. Until now, the security section of an AI vendor comparison was mostly a policy-document diff: training-data usage, retention windows, certifications held. There's now a technically verifiable line item — can we enforce inline control with our own policy engine at the moment before inference? Ask that in your next renewal and the answers will diverge more than you'd expect. But sequence the rollout coldly. Run shadow mode for weeks, not days, and measure your actual deny rate before enforcing. Clean up the role-exclusion list first. And get an executive decision on record for the failure-handling switch, because that single toggle decides whether an outage in a security server stops the company or silently removes the control. That is not a compliance-team decision made alone.

For investors, two signals. One is that AI security is unambiguously where capital is landing right now: Zenity took $125 million the same week, and industry tallies put more than $392 million in new agentic AI security funding announced in the two weeks around RSAC 2026 alone. The second signal is subtler and less comfortable. A model vendor absorbing the control point into its own infrastructure is not good news for startups that were planning to own that spot. Anthropic said the verdict logic belongs to partners — but verdict logic is the asset the incumbent DLP vendors already own. What's left for a newcomer to sell is the layer above it: cross-vendor coverage, agent behavior analysis, context that reduces false positives. Which is exactly the ground Zenity is standing on, and probably not by accident.

For ordinary users, almost nothing changes directly. One thing is worth knowing if you use Claude at work: in an org with this enabled, what you type gets transmitted to a company server whether or not it violates anything. Skimming your employer's AI usage policy once is not a waste of time. Outside work nothing changes at all — this doesn't touch consumer plans, and Anthropic is not running personal conversations through anything like it.

Compressed to a single sentence: the center of gravity in enterprise AI security is shifting away from "block it at the network" and "audit it afterward" toward "an inline gate the model vendor opened for you." Put that next to the study making the rounds recently — humans reviewing AI agent commands approved roughly one in three risky actions across 40,000 simulated runs — and the direction looks less like a product choice and more like arithmetic. Human approval doesn't scale to agent volume. Machines end up checking machines, and Inference hooks is Anthropic's answer to where that check should sit. It carries a beta label, and the docs warn that field names, request shapes and headers may change before general availability. The position, though, has already been claimed.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? If you use Claude on a personal account, nothing at all. If you use Claude Enterprise at work, your full prompts may start routing through a company security server, and some requests can come back blocked with a stated reason. When the internal AI policy notice lands in your inbox, it's worth actually reading this time.

— Why is this happening now specifically? Because Claude stopped being one chat box. The Cowork research preview in late January, general availability plus Managed Agents in April, and MCP connectors and plugins pulling internal data into all of it — employees now touch Claude across web, desktop and CLI. Controlling each door separately hit its ceiling right as the exposure got worse: per Check Point's AI Security Report 2026, the share of prompts carrying sensitive data doubled in a year to one in 25. A single org-wide control became the only sane option.

— Is this ahead of OpenAI and Microsoft? Only partly. Microsoft shipped Purview DLP inside Copilot to general availability in April 2026, so "vendor-embedded real-time control" isn't an Anthropic first. The real difference is ownership: Microsoft keeps the policy engine, Anthropic handed the verdict to the customer's own server. That's more flexible, and it also means the control only works as well as the server your team builds. OpenAI's publicly documented enterprise compliance tooling sits closer to after-the-fact retrieval, which is a different shape of product entirely. Which model becomes the standard is too early to call.

Sources

Numbers and criteria are as of announcement and may change.