Enterprise Adds Skill and Plugin Security Scanning to Catch Malicious Uploads
Anthropic has turned on skill and plugin security scanning in beta for Enterprise plans. When someone uploads or edits a third-party skill or plugin, Claude now automatically checks it for malicious content before it can run — an admin-controlled gate on the growing library of shareable extensions.
It’s a small line in the release notes with a big implication. As skills and plugins become the way teams package repeatable workflows, they also become a supply-chain surface. Scanning uploads is Anthropic acknowledging that a marketplace of executable extensions needs the same hygiene as any package registry.
Inference Hooks Bring Inline Data-Loss Prevention to Every Claude Surface
Inference hooks, now in beta for Claude Enterprise, let a compliance team inspect and enforce policy on every prompt and tool-call response before it reaches the model — across chat, Claude Code, Cowork, and more. Each request routes through a signed WebSocket to your DLP server, which returns an allow/deny verdict that Claude enforces in real time.
Until now, native inline enforcement was limited to Claude Code’s client-side hooks. This closes the gap with one policy layer that also covers tool calls made through MCP connectors, skills, and plugins. Shadow mode, role-based exclusions, and percentage rollouts make it deployable without breaking existing work, and it plugs into the same servers as Netskope, Zscaler, Proofpoint, and Palo Alto.
Claude Code Sessions Learn to Message Each Other — and a Sandbox Bypass Gets Closed
Claude Code 2.1.224 adds cross-session messaging: sessions can now message each other across any of your machines, with ListAgents to discover them (macOS and Linux). A session sends a summary — not your history or files — and the other picks it up mid-task, with crossSessionInbound and dialogExpiry settings to hold or auto-deliver messages depending on permissions.
The same release closes a real security hole: denyRead/denyWrite rules with a path ending in a slash (like ~/.aws/) could be silently bypassed on Linux and macOS — the sandbox thought it was blocking access but wasn’t always. Also new: sandbox credential-masking with JWT-aware maskClaims and AWS SigV4 re-signing. If you rely on deny rules, update now.
Opus 5 Adds Mid-Conversation Tool Changes and a ‘Default’ Fallback Mode
Two agent-focused beta features are live for Claude Opus 5. Mid-conversation tool changes (mid-conversation-tool-changes-2026-07-01) let you add or remove tools between turns while preserving the prompt cache, instead of resending a fixed tool list for the life of a session. And the fallbacks parameter gains a "default" mode that applies Anthropic’s recommended fallback models by refusal category rather than a list you maintain by hand.
One cleanup to note: Fast mode has been removed from Claude Opus 4.7 — requests to claude-opus-4-7 with speed: "fast" now return an error. If you migrated agents to Opus 5 but left an older code path pinned to 4.7 fast, that path will start failing. Worth a grep before Monday.
Claude Code and Cowork Land in Claude for Government on FedRAMP High
Claude Code and Claude Cowork are now in public beta inside Claude for Government Desktop, running in a FedRAMP High authorized environment on the same app commercial customers use. Agencies can point Cowork at local files to draft memos, review RFPs, and build decks, while conversation history stays on the agency-managed device.
The governance layer is the real story: tamper-evident, hash-chained audit logs, two-person approval for sensitive operations, SCIM-driven seat and model limits, and billing that ties AI spend to appropriated funds with a hard not-to-exceed cap. Anthropic remains the contracted and billing party, so agencies skip a separate cloud-provider relationship.
MCP Crosses 400M Monthly Downloads as the 2026-07-28 Spec Rolls Out
The Model Context Protocol has passed 400M monthly SDK downloads — a 4x jump this year — and Claude now lists over 950 MCP servers in its connectors directory, used by millions daily. The new 2026-07-28 spec is one of the biggest yet: a stateless core that lets servers run on serverless and edge, a versioned extensions framework for MCP Apps and Tasks, and auth hardened for production OAuth 2.0 and OIDC.
Alongside the spec, Claude is shipping the connective tissue: enterprise-managed auth (provision a connector once through your IdP), an observability dashboard for connector developers, and MCP tunnels in research preview to reach internal servers without exposing them to the public internet. Intuit, Figma, Zoom, and Netlify are already building on the new spec.
The Throughline Is Trust: Anthropic Is Hardening the Edges
Look at today’s items as one move, not five. Plugin malware scanning, inference-hook DLP, a quietly patched sandbox bypass, FedRAMP High for government, hardened MCP auth — every one is about what happens at the boundary where Claude touches your data, your tools, and untrusted third-party code. As agents graduate from answering questions to executing multi-step work with real permissions, the boundary is where the risk lives.
That focus isn’t incidental. A company steering a confidential IPO through a $965B valuation and toward a public listing later this year doesn’t win the biggest, most regulated accounts on capability alone — it wins them on defensibility. The cross-session messaging feature hints at where the product is going (fleets of agents coordinating work); the sandbox fix and scanning gates are the guardrails that make shipping that safe. The tell of a maturing platform: the flashy feature and the security fix land in the same release.