By ByteBot
Anthropic launched inference hooks on August 5 — a beta feature for Claude Enterprise that intercepts every employee prompt before the model ever sees it. One security server, one organisation-level configuration, and suddenly every Claude surface is covered: chat, Claude Code, Cowork, MCP connectors, skills, and plugins. For enterprise security teams, it is the inline DLP checkpoint they have been asking for since AI landed on the corporate stack.
How It Works
The mechanism is a webhook. When a user submits a governed prompt, Anthropic sends a signed HTTPS POST carrying the conversation transcript to the organisation’s configured AI security server. The server evaluates the content and responds with a verdict: allow or deny. Claude waits for that verdict before generating anything. If the server says deny, the prompt never reaches the model and the user sees a plain-language reason why it was blocked.
The request is signed under the Standard Webhooks specification using a signing secret the organisation generates in the Claude admin console. Your server should reject any unsigned request outright — the docs are explicit on this. The default verdict timeout is five seconds. If your server goes silent, the outcome depends on your org’s configured fallback: allow by default or deny by default.
The verdict schema is minimal:
// Permit the prompt
{"action": "allow"}
// Block it with a user-facing explanation
{"action": "deny", "deny_reason": "Message contains restricted financial data."}That is the entire surface area of the protocol. Intentionally simple.
What It Actually Covers
The scope is broader than it first appears. A single configuration at the organisation level covers Claude.ai chat, Claude Code terminal sessions, Claude Cowork, and every tool call made through MCP connectors, skills, and plugins. When Claude calls a tool — say, pulling a file from Google Drive via an MCP connector — the tool’s response is checked before it is sent back to the model.
Claude Code coverage is the part security teams should notice. Until now, terminal-based Claude Code sessions were effectively a blind spot for corporate DLP tools — no browser proxy catches a CLI agent running on an engineer’s machine. Inference hooks is the first official mechanism that closes that gap.
Build or Buy
Engineering teams have two practical options. The first is to build an AI security server in-house: deploy an HTTPS endpoint on port 443, on a publicly routable host (private IPs and loopback ranges are refused at connect time), verify the Standard Webhooks signature, apply whatever rules you need — regex patterns, ML classifiers, keyword blocklists — and return allow or deny. The protocol is open and the schema is published, so the implementation is straightforward.
The second option is to point inference hooks at a security vendor that has already built the connector. Proofpoint is the most developer-friendly integration at launch: it reuses the DLP rules already governing your email and endpoint traffic with no new rule language required. Zscaler, Netskope, Palo Alto Networks Prisma AIRS, and Check Point also have documented integrations. If you are already running any of those platforms, turning on inference hooks is mostly configuration, not development.
The Gaps — Be Realistic
The current beta has real limitations that matter depending on your use case.
- Binary verdicts only. The whole message either proceeds or it is blocked — there is no mechanism to strip a credit card number and pass the rest of the prompt through. For teams in healthcare or financial services who need smart redaction rather than hard blocks, that is a significant constraint.
- Prompt-side only. Inference hooks only fires before inference. Response-side enforcement — inspecting what Claude outputs before it reaches the user — is listed as planned but is not available today.
- No image inspection. Attachments arrive as extracted text only. A screenshot of a sensitive document is not scanned.
Why This Is Happening Now
Sensitive enterprise data transfers to AI tools increased 93% year-over-year, according to recent reporting. MCP connectors accelerated the problem: Claude can now pull directly from Slack, Google Drive, Microsoft 365, Jira, and Confluence, which means sensitive content that never touched a browser proxy flows straight into the model. Security teams had tools to monitor email and web traffic. They had nothing for AI inference — until now.
Inference hooks is the first time a frontier lab has built native inline DLP interception into the AI platform itself. That sets a precedent. Expect other providers to ship similar mechanisms as enterprise AI governance tightens through the rest of 2026 and into 2027.
If you are running Claude Enterprise, the official announcement and the platform documentation are the places to start. The protocol is open, the vendor connectors are live, and the deployment path is shorter than most enterprise security projects.
