China Rejects the Distillation Report: “Distorting Facts”
Yesterday Anthropic named names. Today Beijing answered. Foreign ministry spokesperson Mao Ning said China “advocates AI for good” and accused Anthropic of “distorting facts” — the first state-level response to a threat intelligence report that identified Alibaba’s Tongyi Lab, Moonshot AI, DeepSeek, Xiaomi and Zhipu as running unauthorized extraction campaigns against Claude totaling roughly 190 million exchanges.
Worth noting what the denial does and does not engage. It disputes the characterization. It does not address the specific mechanics Anthropic documented: more than 151 million exchanges attributed to Alibaba between May and July 2026, peaking near 3 million a day across more than 3,500 accounts Anthropic describes as fraudulent; over 23 million attributed to Moonshot; over 12.1 million to DeepSeek in a fourteen-day window in July. Nor does it touch the part that drew the sharpest coverage — that three of the named labs allegedly routed their own customers’ conversations through Claude, exposing end-user credentials in the process.
The individual companies have not issued substantive public rebuttals of the numbers. That gap matters, because Anthropic’s claims are unusually falsifiable for this genre: dated, counted, and tied to named account clusters. A denial at the diplomatic level and silence at the engineering level is not the same as a factual dispute. It is also, realistically, what you would expect either way — nobody publishes a rebuttal that confirms which accounts were theirs.
Smart Reports Tell You Which of Your Team’s Habits Should Be a Skill
Claude Enterprise gained smart reports in beta. In Anthropic’s framing, they “analyze how a team uses Claude and report on the work getting done, what it costs, where sessions run into friction, and which repeated patterns are worth packaging as shared skills.” That last clause is the interesting one, and it is not a usage dashboard.
Most enterprise AI analytics answer “are people using the thing.” This one is trying to answer “what should we build.” A report that surfaces the same twelve-step workflow appearing in forty sessions across three teams is pointing at a skill somebody should write once. That closes a loop admins previously had to close by intuition — and it is the same instinct behind /skill-doctor and plugin evals: stop guessing at what your Claude deployment is actually doing.
The beta constraints are real, so plan around them. Each organization gets 10 reports per month free during beta, resetting on the first of the calendar month, with more available through your account team. Availability is Enterprise plans only, and it is not available to organizations using customer-managed encryption keys (CMEK) or HIPAA configurations — which excludes a meaningful slice of exactly the regulated buyers most likely to want cost attribution. Access is limited to Primary Owners, Owners, Admins, and custom roles with analytics view permission.
Managed Agents Get a Permission Mode That Thinks, and a Terminal You Can Attach
Two changes landed for Claude Managed Agents that together make long-running server-side agents a lot less of a black box. First, permission policies now include auto: rather than a static allow or deny list, “the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval.” The reasoning is not hidden — agent.tool_use and agent.mcp_tool_use events report how each call was judged in an evaluation field alongside evaluated_permission.
Second, the ant CLI added ant beta:sessions connect, which attaches your terminal to a live Managed Agents session. You can follow it in real time, send messages mid-run, and allow or deny tool calls that are waiting on approval. Pass --web and it serves the Claude Console’s session viewer locally instead.
If you have shipped anything on Managed Agents, you know the failure mode these address: an agent pauses at 2am on a tool call nobody is watching, or worse, an over-broad allow rule lets it proceed on something it should have flagged. auto moves the judgment call server-side, and connect gives you a way in without rebuilding an approval UI. Pair it with the session budget cap shipped in August — sessions that hit the limit pause with a budget_reached event and resume when you raise it — and the operational story for unattended agents is finally coherent.
Plugin Evals: The Only Number That Matters Is Δ
Anthropic published a plugin evals workflow for Claude Code, and it answers three questions plugin authors previously could not measure: does the skill trigger, does it survive an edit or a new model, and does it beat a bare model. The command is claude plugin eval, it needs v2.1.269 or later, and it runs against any directory with a plugin.json or .claude-plugin/plugin.json manifest.
The design is the good part. An eval suite lives in an evals/ directory; each case is a subdirectory with a prompt.md and a graders/ folder. There are six grader types, and four of them cost nothing because they are computed from the transcript and the files on disk: regex, tool_used, tool_order, file_exists. Two call a judge model and bill for it: llm, which scores against prose criteria you write, and baseline, which compares against a reference answer. Frontmatter on the prompt sets max_turns (default 10), timeout_seconds (default 300), model, tags and allowed_tools. And claude plugin eval init will interview you about what a good result looks like, propose cases and graders, try them, and write the files.
By default every case runs twice — a with-arm where the plugin is loaded and a without-arm where it is not. Their difference is Δ, and Anthropic is blunt about it: if a case scores 1.0 in both arms, the plugin is not why it passed. The docs example shows WITH 1.00, W/OUT 0.33, Δ +0.67 across 6 runs at an estimated $0.41 and 74 seconds. The most common first finding Anthropic calls out is a Δ near zero with the tool_used: Skill grader failing — meaning Claude never picks your skill on natural phrasing. That is precisely the defect claude plugin validate cannot see, because it checks manifest syntax, not behavior. For CI, --threshold, --max-cost-usd, --trust-plugin, --json and --no-publish turn it into a gate; budget roughly cases × runs × arms agent runs plus three short judge calls per LLM grader, and remember a usage-limit error can fake a regression.
2.1.268 Quietly Stopped Claude Code From Printing Your Credentials
Buried in a long fix list is a cluster of credential-exposure bugs worth reading as a group. Plugin and marketplace errors were showing a token or password from a git source URL. And /mcp and /plugin server details, claude mcp list, claude mcp get, and MCP login errors were showing secrets resolved from ${VAR} placeholders in MCP configs — meaning the whole point of using an env placeholder was defeated at the moment something went wrong. Both are fixed. If you have pasted Claude Code error output into a ticket or a Slack channel in the last few weeks, that is worth a look.
The permission fixes are the other half. Deny and ask rules on symlinked directories — /etc, /tmp, /var on macOS, /bin on Linux — were not applying when a path was given by its real location. A Read or Edit deny rule did not apply when an env -C, eval or similar unanalyzable command sat on the same line. Edit() deny rules and the write-path check did not cover the file a Bash tee command writes — so a Bash(tee:*) allow rule no longer reaches destinations outside your working directories. And plugin archives extracted for a session were readable by other local users, kept world-writable bits from the archive, and left stale files behind on re-extraction.
Two more with immediate operational value. WebFetch now fails after 300 seconds instead of hanging forever on a server that holds the response open (CLAUDE_CODE_WEBFETCH_DEADLINE_MS overrides it; 0 disables). And sustained high CPU usage is fixed — a busy loop in long-running idle sessions was pinning a core. Also shipped: the Claude apps gateway can set pricing: in gateway.yaml so signed-in clients get the same rates through managed settings and /cost and telemetry finally match the spend meter.
Everything Else in 2.1.269: 98 CLI Changes, and Four You’ll Actually Use
Plugin evals got the headline, but 2.1.269 carried 98 CLI changes. Four are worth putting in your config today. /output-style [name] lists and switches output styles — including over Remote Control and in cloud and other headless sessions, which is the part that was missing. The Bash tool now attaches a diff of the files a command changed to its result when it handles file edits (bashEditDiffEnabled), so edits made through a shell command stop being invisible.
For teams running telemetry: OTEL_METRICS_INCLUDE_REPOSITORY tags OpenTelemetry metrics and events with vcs.* repository attributes, and commit events pick up vcs.ref.head.* when OTEL_LOG_TOOL_DETAILS is on — per-repo cost and usage attribution without building your own join. For inference-bound fan-outs: CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS raises the Workflow tool’s per-run concurrent agent limit, accepting 1 to 256.
The fix list skews toward prompt-cache preservation, which is where the real money is. Fixed: the cache being partially invalidated on the turn after a response was cut off at the output-token limit and auto-resumed; and resuming a session after interrupting Claude mid-thought changing how earlier context was re-sent. Both were silent cache misses you paid for without seeing. Elsewhere: CMYK JPEGs now attach instead of failing to decode, prompt suggestions no longer get dropped for Japanese, Chinese and Thai and other languages written without spaces, and a deny or ask rule starting with ! now applies only within the settings source that wrote it. VS Code got an agent map — an “N agents” footer pill opens per-agent cards with Stop and read-only transcripts — plus Hooks and Permission rules dialogs.
4,000+ Skills, 700+ MCP Servers, and a Command That Tells You Which Ones Are Dead Weight
The third-party skills ecosystem has passed the point where browsing it is a strategy. Aggregators now index on the order of 4,200+ skills, 727+ MCP servers and 2,500+ plugin marketplaces, with individual catalogs claiming 800+ free skills and 3,600+ Claude Code skills. Recent additions include a Hugging Face Spaces MCP filter, Conare as an MCP memory layer, an official Figma MCP catalog, and claude-plugins.dev as a CLI.
Which makes /skill-doctor (v2.1.252+, shipped September 4) the most underrated command of the month. It reports which loaded skills a session never used, and what each one costs in context on every turn. The mechanic behind it is worth knowing even if you never run it: Claude Code loads a listing of skill names and descriptions so Claude knows what is available, and that listing’s character budget scales at 1% of the model’s context window. When it overflows, Claude Code drops descriptions starting with the skills you invoke least — so your most-used skills keep their full text, and your long tail silently degrades.
Put the three tools together and you get a real workflow. /skill-doctor tells you what to turn off. claude plugin eval tells you whether what is left is earning its keep. Smart reports tell an admin what the whole org should have built in the first place. Six weeks ago the answer to “is this skill helping?” was vibes. Now it is three commands.
The October Listing Is the Backdrop to Everything Shipping Right Now
Anthropic is reported to be positioning for an October 2026 public offering at a target valuation around $2 trillion, per Bloomberg and Fortune reporting — up from a private valuation near $965 billion set in a May 2026 Series H. Analysts peg that at roughly 30 times revenue, which is either a comment on growth or a comment on the market, depending on your disposition.
The competitive numbers underneath it are not soft. Menlo Ventures puts Anthropic at 40% enterprise spend share against OpenAI’s 27% and Google’s 21%. On coding, independent evaluations put Claude Opus 5 at 96-97% on SWE-bench Verified, ahead of GPT-5.3 Codex at 85%. And the Claudeforce partnership makes Claude the default reasoning engine across Salesforce’s Agentforce stack, with the Salesforce in Claude plugin and its 37 prebuilt sales skills due in open beta this month.
Why this belongs next to a changelog: the release cadence reads differently once you account for it. Plugin evals, smart reports, permission policies, gateway pricing parity, telemetry attribution — none of these are consumer features. They are the things a procurement committee asks about, shipped in the quarter before a listing. That is not cynicism; it is just what maturity looks like from the outside. It does mean you should read this month’s roadmap as answering enterprise objections rather than pushing capability frontiers.
The Vibes Era Just Ended, and Nobody Announced It
There is a quiet pattern in this week’s shipping that is easy to miss because none of the individual items are exciting. /skill-doctor measures what your skills cost. claude plugin eval measures whether your plugin does anything. Smart reports measure what your organization’s usage is worth. OTEL_METRICS_INCLUDE_REPOSITORY measures it per repo. Gateway pricing parity makes /cost match the actual bill. Managed Agents auto reports why each tool call was allowed. Every one of these replaces a judgment call with a number.
That transition has a name in every previous software era, and it is not glamorous: instrumentation. It is what happens when a technology stops being interesting enough to justify itself and starts having to prove it. The honest read of “if a case scores 1.0 in both arms, the plugin is not why it passed” is that a lot of plugins score 1.0 in both arms. Anthropic shipped the tool that says so, and told you the most common first finding is that your skill never triggers on natural phrasing. You do not build that feature, or document that failure mode so prominently, unless the ecosystem is full of skills that do not work and authors who cannot tell.
Which makes the Δ metric the most important thing Anthropic shipped this week, and I do not think that is close. An entire cottage industry has grown up around Claude skills — 4,000-plus published, 2,500 marketplaces — on the strength of assertions nobody could check. A free, local, reproducible A/B against a no-plugin baseline is a solvent for that. Some very popular skills are about to find out they are decoration. The ones that survive get something they have never had, which is evidence.
The distillation fight is the same story at a different scale, and this is where Beijing’s denial gets interesting. Anthropic’s report works precisely because it is instrumented: dated windows, counted exchanges, named account clusters, quoted extraction prompts. “Distorting facts” is a claim about framing, and framing is the one thing numbers are bad at defending against. But notice that the asymmetry runs both directions. Anthropic can measure extraction from its own logs; it cannot measure what Qwen 3.7 actually learned. It can show you 151 million exchanges leaving. It cannot show you capability arriving. The gap between those two is where the whole dispute lives, and no amount of telemetry closes it.
So here is the thing I would hold onto. A company about to go public spent this week shipping tools that make its own ecosystem’s claims falsifiable, while publishing a report whose central claim about competitors is falsifiable only by the competitors. Both are instrumentation. Only one is aimed inward. The plugin authors are getting a measuring stick. The labs are getting an accusation. If you want a single test for whether this week was about rigor or about positioning, it is whether Anthropic ever ships something that lets an outsider audit the distillation claims the way plugin eval lets you audit a skill. Until then, run the eval on your own plugins. That part is real, it is free, and it will probably embarrass you.