2026-08-09 – Enterprise Inference Hooks and Cross-Company Jailbreak Severity Standards

🧭 Enterprise Inference Hooks: Real-Time DLP Before Every Claude Prompt

Anthropic has shipped inference hooks in beta for all Claude Enterprise organisations — a vendor-agnostic inspection layer that intercepts every governed prompt before the model sees it. The organisation's AI security or DLP server receives the full conversation transcript via a signed HTTPS POST, returns an allow or deny verdict within 5 seconds, and Claude either proceeds or halts. Denied prompts never reach the model.

How it works

When inference hooks are configured, every covered request follows this path:

Claude receives the user's message but pauses before inference.
Anthropic sends a POST to the organisation's configured endpoint with the transcript, signed using the Standard Webhooks spec (webhook-id / webhook-timestamp / webhook-signature headers, HMAC-SHA256).
The AI security server inspects the content and returns a compact JSON verdict.
Claude either generates a response (allow) or returns a denial message (deny).

# Allow verdict
{ "action": "allow" }

# Deny verdict — deny_reason shown to user; reference_id logged
{
  "action": "deny",
  "deny_reason": "This request contains regulated financial data. Please remove account numbers before continuing.",
  "reference_id": "dlp-event-20260809-00421"
}

Scope and limits

Covered surfaces: claude.ai chat, Claude Cowork, and Claude Code sessions for Enterprise orgs.
Not covered: Amazon Bedrock or Google Cloud deployments; voice mode; system prompts; raw file bytes and images (text content of attachments is included).
Timeout: 5,000 ms default (configurable 1–10,000 ms); one automatic retry after 100 ms on connection failure only.
Failure mode: configurable as "block the request" (fail-closed) or "allow the request" (fail-open).
Source IPs: 160.79.106.0/24; User-Agent: anthropic-dlp/1.
Request schema fields: type (always "prompt" today), request_id, tenant_id, actor (user id + email), source.application (claude-ai or claude-code), messages, session_id, model.

Rollout controls

Inference hooks ship with three safeguards designed for phased enterprise deployments:

Shadow mode: hooks receive the request and return verdicts, but Claude ignores denials — lets you measure false-positive rates before enforcement goes live.
Rollout percentage: inspect 0–100% of requests, so you can start with a small traffic slice and increase gradually.
Role-based exclusions: custom roles (e.g. IT admins, security analysts) can be exempted from inspection.
Circuit breaker: sustained hook failures automatically stop enforcement; an admin must manually re-enable. Every denial is recorded in the Compliance Activity Feed.

What to build your hook server with

The inference hooks endpoint is fully vendor-agnostic: any organisation can implement the HTTPS endpoint themselves or use a security vendor that supports the Standard Webhooks spec. The system prompt, file bytes, and images are never sent to your hook server, so your DLP logic sees only the text conversation — the same transcript a human reviewer would read. Start with shadow mode on 5–10% of traffic, tune your rules, then raise rollout percentage and switch to enforcement.

⭐⭐⭐ platform.claude.com

🧭 Four-Factor Jailbreak Severity Framework: Anthropic, Amazon, Microsoft, and Google Align on Standards

Buried inside Anthropic's August 7 post on Fable 5 biology safeguards is a quietly significant announcement: Anthropic is working with Amazon, Microsoft, and Google to develop a shared jailbreak severity taxonomy for scoring how dangerous a discovered bypass technique actually is. The goal is to give AI companies a common language for evaluating and disclosing vulnerabilities — similar in intent to the CVSSv3 scoring system used for software security.

The four scoring dimensions

The emerging framework rates every reported jailbreak across four factors:

Capability gain: does the bypass actually unlock new harmful capability, or does it merely produce off-topic content? A technique that enables synthesis routes for dangerous pathogens scores highest here.
Breadth of capability gain: how wide is the uplift — a narrow edge case, or a reliable unlock of a broad category of restricted behaviour?
Ease of weaponisation: could a low-skill actor exploit this with minimal effort, or does it require specialist knowledge to operationalise?
Discoverability: is the technique already publicly known (and therefore already in adversary playbooks), or is it novel?

Why this matters for operators

A standardised severity score means AI vendors can disclose jailbreaks with a common vocabulary instead of ad-hoc "critical / high / medium" labels that differ by company. For operators building on Claude, it creates a path toward structured vulnerability notifications — similar to how CVE advisories work in software — so you know whether a disclosed technique is a hypothetical edge case or something you need to respond to immediately. The framework is still in development; watch Anthropic's safety research publications for a formal specification.

Context: why this framework is being built now

The June 12 incident — in which Amazon researchers discovered a bypass that caused Fable 5 to provide dangerous biology assistance — forced Anthropic to suspend two flagship models and collaborate with US government agencies for 18 days. That episode exposed a gap: when a cross-company team is responding to an AI security incident in real time, there was no shared vocabulary for quickly communicating how serious a newly found bypass actually was. The four-factor framework is a direct response to that gap, designed to let AI companies, researchers, and regulators communicate severity without ambiguity.

⭐⭐⭐ anthropic.com