Drop #23: Anthropic Builds Its Own Guardrails Into Cowork

Last week's drop covered a third-party vendor building guardrails around Cowork. This week Anthropic answered with a governance stack of its own: three enterprise security features shipped in seven days, and all three cover Cowork directly - inline data loss prevention, security scanning for skills and plugins, and Compliance API coverage for Cowork sessions.

Inference Hooks: Real-Time DLP Across Every Claude Surface

On August 5, Anthropic launched inference hooks in beta for Claude Enterprise. When an organization turns them on, every prompt and every tool-call response routes through the org's own security server before it reaches the model - and Claude waits for an allow-or-deny verdict before proceeding. That check covers tool calls made through MCP connectors, skills, and plugins, which is most of what a Cowork session does.

The protocol is an open, webhook-based schema, so companies can point Claude at the DLP infrastructure they already run - Anthropic names Netskope, Palo Alto Networks, Proofpoint, and Zscaler - or a server they built in-house. Rollout controls include shadow mode (log everything, block nothing), role-based exclusions, and percentage-based rollouts. Until now, native inline enforcement was limited to Claude Code's client-side hooks; this closes the gap for chat and Cowork with one org-level configuration.

Skills and Plugins Get a Security Scanner

The next day, August 6, Anthropic's release notes added skill and plugin security scanning, also in beta for Enterprise plans. With it enabled, third-party skills and plugins are automatically checked for malicious content whenever someone uploads or edits them. Skills are instruction bundles that Claude follows during a session, so a poisoned one is effectively a prompt-injection payload with distribution - scanning them at upload is the right choke point.

The Compliance API Now Sees Cowork Sessions

Then on August 11, Anthropic extended its Compliance API to cover Cowork and Claude Code, in beta for Claude Enterprise. Security teams already using the API for Claude chats can now pull Cowork sessions through the same interface - across desktop, web, and mobile - as consolidated, server-hosted transcripts that bundle prompts, responses, and tool activity into a single session record.

Each record carries session content (prompts, responses, web and MCP tool-call content, skills and artifacts as transcript text) and metadata (verified user ID and email, organization ID, session and per-message IDs, timestamps). The endpoints are additive, work with existing Compliance Access Keys, and can run alongside OpenTelemetry exports. The beta excludes Claude Code on the web and sessions run through the Claude Platform, Bedrock, Vertex AI, or Microsoft Foundry.

Why This Matters for Cowork Users

Put the three together and the pattern is clear: Anthropic is building the visibility and enforcement layer that enterprise security teams were previously getting only from third parties - or not at all. For Cowork specifically, the practical change is that sessions are no longer a blind spot. If your org is on Enterprise, your admins can now see session transcripts, gate tool calls in real time, and scan the skills people upload. If you have been waiting for a green light to use Cowork on sensitive work, these are the controls your security team was waiting for.

Tip of the Week: Read a Skill Before You Install It

Anthropic now scans skills and plugins for Enterprise orgs - but on Pro and Max, you are the scanner. A skill is a set of instructions Claude follows in your session, with your files and connectors. Treat installing one like running someone else's script.

❌ Weak

Install a skill file someone shared because the name sounds useful, and find out what it actually instructs Claude to do while it is doing it.

✅ Strong

Before installing, open the SKILL.md and read it: what does it tell Claude to do, which tools does it reach for, and does anything in it send data somewhere you did not expect?

The rule of thumb: a skill is a standing instruction set, not an app from a vetted store. If you would not paste its contents into chat yourself, do not install it.

Worth Reading This Week

Two drops, two halves of the same story: the ecosystem watching Cowork from the outside, and Anthropic wiring controls in from the inside. Enterprise adoption tooling is arriving fast - worth knowing what your org has turned on.

Until next time.

— The ClaudeCowork.com team