Anthropic has introduced a new security layer called inference hooks that inspects every employee prompt before it reaches Claude, giving enterprises real-time control over what data enters their AI conversations. The beta feature, launched on August 5, 2026, routes prompts through an organization's own security server for an allow-or-deny verdict before the model ever processes the request.

How Does This New Security Checkpoint Work?

Inference hooks operate at a critical moment in the data flow. When a user submits a prompt on Claude Enterprise surfaces, Anthropic sends the conversation transcript to the organization's security server over a signed connection and waits for a verdict. If approved, inference proceeds normally. If denied, the request never reaches the model, and the user sees a blocked-by-policy message that administrators can customize with guidance on requesting exceptions.

The system inspects not only what employees paste into Claude Code and chat sessions, but also what comes back from connected tools. When Claude invokes a tool, including tools connected through MCP connectors, skills, and plugins, the tool's response is checked before it returns to the model. This two-way inspection closes what security researchers have identified as a major vulnerability: sensitive data entering conversations from external systems, not just data employees manually input.

The verdict itself is a small JSON object, and the security server must respond within a configurable timeout, set to five seconds by default. Requests are signed under the Standard Webhooks specification, allowing organizations to verify that traffic genuinely came from Anthropic.

What Information Does the Security Server Actually See?

Anthropic has carefully defined what data flows to the security server and what remains hidden. The server receives transcript text, tool calls and their results, and text extracted from attachments. Critically, it never receives raw file or image bytes, system prompts, or tool definitions. Ancillary requests like conversation title generation skip the endpoint entirely, and voice mode is not covered by the feature.

This design reflects a balance between security oversight and privacy protection. Organizations get visibility into the substance of what employees are sharing with Claude, but not into the underlying system instructions or raw media files that might contain sensitive metadata.

Steps to Deploy Inference Hooks in Your Organization

• Shadow Mode Rollout: Observe verdicts on live traffic without blocking anything, allowing security teams to tune policies before enforcement begins.
• Gradual Percentage Rollout: Inspect a chosen fraction of requests rather than 100 percent of traffic, reducing the risk of blocking employees on day one.
• Role-Based Exclusions: Exempt members of chosen roles entirely, such as executives or trusted security personnel who may need unrestricted access.
• Failure Posture Configuration: Choose whether to block requests or let them through uninspected if the security server is unreachable, errors, or exceeds the timeout threshold.

This phased approach acknowledges a hard-won lesson from data loss prevention (DLP) deployments across email and web traffic: aggressive blocking on day one is how DLP programs lose organizational support and get disabled.

Which Security Vendors Can Integrate With Inference Hooks?

Anthropic is not selling its own scanning engine. Instead, the company published a webhook-based protocol with a documented schema, allowing security vendors to build integrations. Anthropic named Netskope, Palo Alto Networks, Proofpoint, and Zscaler as destinations organizations can point the hook at, alongside in-house servers.

This architecture inverts the typical DLP deployment model. Rather than a vendor's appliance chasing AI traffic across the network, the AI provider calls the vendor's verdict API on every request. The approach gives security vendors a direct window into Claude conversations without requiring network-level interception, which can struggle with encrypted and dispersed AI traffic.

What Are the Current Limitations of Inference Hooks?

The feature's current scope reflects Anthropic's cautious rollout strategy. Verdicts are binary: the security server can allow or deny a prompt, but cannot rewrite or redact one. Attachments arrive as metadata and extracted text, so image-only content, such as a screenshot of a document, goes uninspected. The only hook event at launch fires on the prompt before inference; response-side enforcement, checking what the model returns, is planned as a later event.

Geographically and architecturally, the feature governs Claude Enterprise surfaces only. API access through the Claude Platform is out of scope, and organizations running Claude on Amazon Bedrock or Google Cloud get nothing. This limitation means enterprises using Claude through cloud partners will need to wait for future integrations or rely on network-layer controls.

The documentation lists four primary use cases for inference hooks: data loss prevention as the most common deployment, real-time transcript archival as a push-based alternative to polling Anthropic's Compliance API, prompt telemetry captured at the moment of use, and custom policy engines enforcing rules like model allowlists or project-scoped restrictions before inference.

How Does This Compare to Other Security Approaches?

Inference hooks represent one approach in an emerging contest over where AI security checkpoints should live. Network-layer controls, such as those offered by Check Point, see whatever crosses the wire but strain against encrypted and dispersed AI traffic. Provider-side hooks like Anthropic's see exactly what the model would see, but only inside one vendor's perimeter. Each approach has trade-offs in visibility, coverage, and implementation complexity.

Inference hooks is available in beta to Claude Enterprise organizations, with configuration gated behind the organization's admin roles. The prompt event is live across claude.ai, Cowork, and Claude Code sessions on the web, desktop, and CLI. Anthropic's documentation frames response-side enforcement, checking what the model returns before sending it to the user, as the next checkpoint to arrive.