Key takeaways
- On August 5, 2026, Anthropic launched inference hooks in beta for Claude Enterprise customers: every prompt is submitted to the company's security server, which answers allow or deny before inference starts.
- A single configuration covers chat, Cowork, the coding tool and tool calls made through MCP (Model Context Protocol) connectors, on the web, the desktop app and the command line.
- The protocol relies on signed webhooks and plugs into existing DLP servers (Netskope, Palo Alto Networks, Proofpoint, Zscaler), with a 5-second default response timeout.
- According to a survey commissioned by the law firm Kolmogorov Law in July 2026, 38% of the 500 US workers polled had already entered company information into a personal AI account.
What Anthropic announced on August 5
On August 5, 2026, Anthropic introduced inference hooks, a beta feature restricted to Claude Enterprise customers. The principle fits in one sentence: before the model reads a prompt, the content is sent to the company's security server, which returns a binary verdict, allow or deny. Blocked content never reaches Anthropic's servers.
The same check applies to the responses of tools the assistant calls mid-task. When an agent queries a CRM or a document base through an MCP connector, the result is inspected before it comes back to the model. One configuration, set at the organization level, covers chat, Cowork and Claude Code, on the web, the desktop app and the command line, as Unite.AI's technical breakdown details.
On the integration side, Anthropic chose an open protocol built on signed webhooks, with a published schema. A company can point it at the DLP (Data Loss Prevention) server it already runs, such as Netskope, Palo Alto Networks, Proofpoint or Zscaler, or at a server built in-house. The response timeout is 5 seconds by default, configurable, and rollout can be gradual: shadow mode with no blocking, role-based exclusions, percentage-based ramp-up.
"This lets us safely move faster on AI without giving up control," says Andrew Grimmett, VP of Information Security at the US operator Bandwidth, quoted in Anthropic's announcement.
Why does this control point matter?
Because it moves data governance from the network to the prompt. Security teams have inspected email, web traffic and file sharing for years; conversations with an AI remained a blind spot, poorly covered by network tools designed before assistants existed, and blind as soon as usage goes through a desktop app or a terminal. As The Next Web notes, there was until now no central enforcement point covering every surface of an enterprise assistant.
The novelty is not DLP, an old technology. The novelty is that the model provider itself opens a standardized control point inside its product, and lets the customer decide in real time what the model is allowed to read. The balance of power flips: the client company no longer has to take the provider's word for it, it holds the tap.
The stakes reach far beyond large accounts. According to the security vendor Cyberhaven, which analyzes its customers' data flows, close to 40% of AI usage in companies involves sensitive data. When one channel concentrates that share of critical information, control tooling always follows; that is exactly what is happening now.
What does it change for a small or mid-sized company?
A company with 10 to 100 employees usually has neither a Claude Enterprise subscription nor a DLP server. The announcement still concerns it, for three reasons.
First: the leak channel is real, and it runs primarily through personal accounts. According to the survey commissioned by Kolmogorov Law in July 2026 among 500 US workers, 38% had already entered company information into a personal AI account their employer does not control, and 23% had pasted internal emails or documents into one. When that information contains customer data, the issue is no longer just confidentiality: in Europe, it is GDPR.
Second: outright bans do not work. The same survey shows that 64.4% of workers do not know that entering company information into a personal AI can, in some cases, be illegal. An employee who is denied the tool without an alternative switches to a personal phone, where the company sees nothing. Providing a managed business account, with the right retention and privacy settings, protects better than a memo.
Third: safeguards stack up, and they do not all cost the same. The table below sums up the four levels, from cheapest to heaviest.
| Safeguard | Setup cost | What it covers | Its limit |
|---|---|---|---|
| Usage policy and training | A few hours | Reflexes: what to paste, what never to paste into a prompt | Relies on individual discipline |
| Managed business accounts | In the range of a few dozen euros per employee per month | Retention, privacy, visibility on usage | Does not cover personal accounts |
| Network blocking of unapproved tools | Existing firewall or proxy | Access from the company network | Bypassed by personal phones |
| Prompt-level control (inference hooks) | DLP server plus enterprise plan | Every prompt and every tool call, before the model | Restricted to enterprise plans, all-or-nothing verdict |
For most small businesses, the first two rows handle the bulk of the risk at close to zero cost. A technical control at prompt level is only worth it when the data handled is regulated: healthcare, finance, data about minors. In every other case, the budget is better spent on team training than on oversized security tooling.
Allow or deny: the limits of all-or-nothing
Anthropic's system has documented limits. The security server cannot rewrite or redact a prompt: it passes it whole or blocks it whole. Images are only inspected through their metadata and the text extracted from them. The control covers neither the API nor deployments through Amazon Bedrock or Google Cloud. Verification of the model's responses is announced for later.
The most revealing setting is the failure policy: if the security server does not answer in time, should the request go through or be blocked? Each company has to choose between availability and tightness; there is no universal right answer. Shadow mode, which allows everything but logs everything, is in my view the best idea in the announcement: measure what teams actually send before deciding what to block. A badly tuned safeguard pushes people to work around it, and the workaround leads back to the personal account, which is where the problem started.
In the systems I build, this question, "what does the model see?", is settled in the specification rather than after the fact. On the Emma CRM for the 3018 hotline, France's national number against cyberbullying, which I co-built for e-Enfance, the integrated AI is sovereign and hosted in France, precisely because the conversations involve minors. For an SME AI agent, the logic is the same at a smaller scale: decide at design time which data the agent may read, and which data never leaves your system. It is less spectacular than a DLP server, and often more effective.
The real question is no longer whether your teams use AI: they already do, sometimes from an account you cannot see. The question is what the model is allowed to read, and who decides. On August 5, Anthropic gave its answer: the customer. Every company, even without a security budget, is better off writing down its own.
Frequently asked questions
What is an inference hook?
An inference hook is a control point Anthropic launched on August 5, 2026 for Claude Enterprise: before the model reads a prompt or a tool response, the content is submitted to the company's own security server, which allows or blocks it. Blocked content never reaches Anthropic's servers.
Can a small business turn on inference hooks?
Not directly: the feature is in beta, restricted to Claude Enterprise customers, and it assumes a security server able to return a verdict within seconds. A small business gets most of the protection from managed business accounts, a clear usage policy and short team training.
How can you limit data leaks into AI tools without a security budget?
Three steps cover the basics: map who uses which AI tool and for what, provide business accounts instead of letting personal accounts spread, and write down in plain language what must never be pasted into a prompt. According to a July 2026 survey commissioned by Kolmogorov Law, 38% of US workers surveyed had already entered company information into a personal AI account.