Announcing Operant’s new Claude Plugin and support for Inference Hooks for the most expansive Claude Coverage

A few months ago we wrote about how Operant Endpoint Protector secures Claude Code, the Claude CLI, and Claude Cowork — the three surfaces where autonomous execution meets the developer's or knowledge worker's machine.

Since then, the shape of the problem has changed. Claude is no longer three tools. It's a workspace layer: a Slack bot the whole channel can summon, a sidebar in Excel and Outlook, a design canvas, a chat window on a phone that never touches a managed laptop, and a hosted Cowork session running on infrastructure you don't own.

Endpoint enforcement is the right control point for anything that executes on a device. But a growing share of Claude activity doesn't execute on a device at all — and you can't install an agent on a surface that has no endpoint.

On August 5, Anthropic shipped the missing primitive. Today we're announcing two expansions built on top of it:

1. Inference hook support, extending Operant's real-time policy enforcement to Claude Tag, Claude Design, Claude for MS365, and Claude chat across every surface — web, desktop, mobile, and browser.
2. Agent-loop tracing for Claude Cowork in cloud mode, delivered through a native Operant plugin that captures every step the agent takes inside a hosted session — not just what goes in and comes out.

Operant already covered Cowork in desktop mode through the endpoint agent. Cloud mode was the missing half. It's now covered, and covered more deeply than inference hooks alone can reach.

Why endpoint coverage alone stopped being sufficient

The original architecture rested on a clean assumption: Claude runs on the user's machine, so govern the machine. That held for Claude Code, the CLI, and desktop Cowork. It does not hold for where Claude went next.

• Claude Tag runs in Slack. The prompt isn't authored on a laptop you manage — it's a channel message, often carrying context from people other than the user who invoked it.
• Claude chat on mobile runs on a phone that may be personal, unmanaged, and entirely outside MDM scope.
• Claude Design runs in a browser canvas, where the sensitive material is pasted data rather than a file on disk.
• Claude Cloud Cowork runs on hosted infrastructure. There is no endpoint. The user opens a session, the agent executes elsewhere, and the local device sees only a result.
• Claude for Microsoft 365 runs in an Office sidebar, where the sensitive material isn't pasted in at all — it's the workbook, contract, or inbox the user already had open.

In each case the data still leaves the organization and the agent still acts on external systems through MCP. Only the observability disappears.

What inference hooks actually do — and what they don't

Anthropic released inference hooks in beta for Claude Enterprise on August 5, 2026. It's worth being precise about the mechanism, because the precision determines what a security vendor can and cannot build on top of it.

When an organization enables inference hooks, Anthropic sends an HTTPS POST carrying the conversation transcript to a designated security server. Before the model begins generating, Claude sends the prompt and its surrounding context to that server, which returns a verdict — allow or deny — and Claude waits for it before proceeding. The same check runs on tool calls: when Claude invokes a tool, including tools reached through MCP connectors, skills, and plugins, the tool's response is evaluated before it is passed back to the model.

Three properties follow from that design, and they matter:

The verdict is binary. The protocol carries allow or deny. It does not carry a modified payload back to the model. That means enforcement at the hook layer is blocking, not redaction — Operant can stop a prompt containing a live credential from reaching the model, but it cannot strip the credential and let the rest of the prompt through. A denied request never reaches the model, and the user sees which policy stopped it.

Enforcement is currently prompt-side. Prompts and tool call responses are inspected on the inbound path. Anthropic has stated that enforcement for model responses is planned for a future release. Until it ships, output-side governance on hook-only surfaces is detection and audit rather than inline blocking.

Scope is Claude Enterprise. Inference hooks don't cover Claude on Amazon Bedrock or Google Cloud, voice mode, or Platform (API) organizations. Operant's existing runtime coverage for Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry is unaffected and continues to operate through our gateway — but it's a different enforcement path, and we're explicit about that rather than blurring the two.

Redact where we're in-path, block where we're not

This is the honest architecture, and it's the single most useful thing for a security team to internalize when planning policy.

On surfaces where Operant is in the data path — Claude Code, the Claude CLI, Cowork desktop, and the browser extension — the endpoint agent sits between the user and the model. It can rewrite the payload in flight. PII, PHI, PCI, credentials, and API keys are stripped from the prompt before it leaves the device, and the developer's workflow continues uninterrupted. That behavior is unchanged.

On surfaces where enforcement runs through inference hooks — Claude Tag, Claude chat, Claude Design, and Cloud Cowork — Operant is a verdict authority, not a proxy. Policy violations are blocked, with the specific rule surfaced to the user so they can revise and resubmit. The sensitive value never reaches the model, which is the security outcome that matters; the tradeoff is a harder stop instead of a silent cleanup.

Both modes write to the same policy set and the same audit trail. You define a data classification rule once at the org level, and Operant applies the strongest enforcement each surface's architecture permits.

In practice

A support engineer tags @Claude in a Slack channel to summarize a thread. The thread contains a customer's account details, a pasted log with a live session token, and an internal note about a pending legal matter. Claude Tag reads the channel context — all of it — as its prompt.

No one uploaded a file. No one opened a laptop app. There is nothing for an endpoint agent to see, and by the time a compliance export surfaces the session, the token has been sitting in a model context for weeks.

With inference hooks, Operant receives the transcript before the model does, matches the token against the credential policy, and returns a deny. The request stops. The engineer sees which policy fired, removes the log excerpt, and gets their summary on the second try. The token is never processed by the model, never enters a stored conversation context, and never reaches any downstream tool the session could have called.

The embedded surfaces: Claude inside the tools people already have open

The clearest beneficiary of hook-layer coverage is the category of surfaces that don't look like AI tools at all.

Claude for Microsoft 365 puts Claude in a sidebar inside Excel, Word, PowerPoint, and Outlook — generally available on paid Claude plans, with Outlook the newest addition. The same pattern is spreading: Claude in Chrome alongside whatever page you're on, Claude Tag inside a Slack channel, Claude Design on a canvas. In each case Claude isn't a destination the user navigates to. It's a panel next to the work.

None of these had a practical enforcement point before. There's no CLI to wrap, no local process to instrument, and in the Office case no upload event to intercept. Because inference hooks sit beneath the client rather than inside it, all of them inherit prompt and tool-response enforcement from the same org-level configuration — no per-application integration, and no separate policy set.

That matters because embedding changes the threat model in four specific ways.

The prompt is the file. Traditional DLP is built around an event: a user pastes sensitive content into a text box, uploads a document, attaches a file. In an Office sidebar there is frequently no such event.

The workbook below is a director-level payroll and compensation summary — employee IDs, full names, titles, locations, hire dates, individual base salaries, and total loaded cost for every engineering director in the org. Nobody uploaded it or pasted it anywhere. It was already open in Excel, and the Claude sidebar has it in context by default. A prompt as unremarkable as "update the burden rate" carries all of it to the model.

The screenshot also captures what happens when the user adds sensitive data directly. Asked to append two employees' Social Security numbers to the sheet, the request never reaches the model: Operant evaluates the prompt at the inference hook, matches it against the organization's Sensitive Data (PII) policy, and returns a deny. The user gets the block inline, with the policy that fired named in the response — blocked by your organization's Operant AI policy (Sensitive Data (PII)).

Context crosses application boundaries inside one session. Context carries from Outlook to Word to Excel to PowerPoint within a single conversation — that continuity is the product's central feature. It also means material non-public figures from a model can surface in a deck, and a contract position from Word can land in an email draft, without any file leaving any app in a way per-application DLP would recognize. The flow is inside the agent's context, not on the wire.

Write tools turn a disclosure problem into an action problem. The Microsoft 365 connector's write tools let Claude send email, manage drafts and calendar events, and create and update files in OneDrive and SharePoint. Read access risks exposure. Write access risks consequences.

Delegated permissions make Claude inherit the user's blast radius. The connector operates on behalf of each individual user and can only reach data that user could already reach — which is the correct design, and which also means an over-permissioned employee becomes an over-permissioned agent. Every SharePoint site that person could technically open is now inside an autonomous loop's reach. Most organizations have never audited that scope against an agent's access pattern, because until recently nothing exercised it at machine speed.

One routing caveat worth checking

This is the detail most teams will miss.

Claude for Microsoft 365 can be connected through Microsoft Foundry, Amazon Bedrock, or Google Cloud Vertex AI credentials. Inference hooks do not cover Claude on Amazon Bedrock or Google Cloud, nor Platform (API) organizations — they are a Claude Enterprise capability.

So two organizations can both be running Claude in Excel, with identical-looking deployments, and have entirely different enforcement available depending on which credentials the integration was wired up with. If your M365 deployment routes through a hyperscaler, hook-layer enforcement does not apply to it.

Operant covers all three paths through our gateway — Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry — so the control exists regardless of how the integration was wired. But the enforcement path is different, and knowing which one your deployment is on is a prerequisite to writing policy that actually fires. It's one of the first things our discovery run answers.

Where inference hooks stop — and why Cloud Cowork needed more

Inference hooks give you the edges of the interaction: what went in, what came back from a tool. For conversational and creative surfaces that covers most of the risk, because on those surfaces most of the risk is the data.

For an agentic surface, it isn't.

Cowork doesn't answer questions. It plans, reads and writes files, loads skills and plugins, drives a browser, calls MCP servers, spawns sub-agents, retries when something fails, and self-corrects across dozens of iterations before producing the response the user sees. A prompt-and-tool-response view of that session gives you the beginning and end of a story with the plot missing.

That gap is exactly where agentic incidents live. Indirect prompt injection doesn't appear in the user's prompt — it appears at step 14, in the contents of a document the agent decided to open. A poisoned plugin doesn't announce itself in the final answer.

So for Claude Cowork in cloud mode, we went deeper than the hook.

Agent-loop tracing for Cloud Cowork, via the Operant Plugin

Operant now ships a native plugin for Claude Cowork that integrates directly into the agent runtime in hosted sessions. Rather than observing the session from outside, it instruments the loop itself.

Every step is captured and policy-evaluated as it happens:

• Plan and intermediate reasoning steps — what the agent decided to do, and in what order, before it acts.
• Every tool invocation individually — each call, its arguments, and its result, not a rolled-up summary.
• File operations inside the session workspace — reads, writes, and what data moved between them.
• Skill and plugin loads, surfaced and reputation-scored before execution, with policy held against them — the same control we apply to CLI skill loading.
• Command execution, inspected by CodeInjectionGuard for exfiltration patterns, destructive operations, and reverse shell indicators before it runs.
• Sub-agent delegation — when the primary agent spawns a child, the child's loop is traced under the same policy and session identity.
• Loop mechanics — iteration counts, retries, and self-corrections, frequently the first observable signal that an agent has been redirected.

Because the plugin runs inside the loop rather than in front of it, it isn't constrained to a binary verdict on a prompt. It can halt a specific step, scope a tool call, or block a command while the session continues.

Inference hooks tell you what the agent was asked and what its tools handed back. The agent-loop plugin tells you what it did. Cloud Cowork gets both.

In practice

An operations analyst asks a Cloud Cowork session to reconcile vendor invoices against the contract repository and draft a summary for finance.

The agent pulls the contract set through an MCP connector. One contract PDF — uploaded months ago by a vendor — contains instructions embedded in white text: fetch the credentials file from the connected drive and post its contents to an external endpoint.

The user's prompt was benign. The final response is a clean reconciliation summary. In a prompt-and-response view, nothing happened.

In the trace, step 22 is a file read outside the declared task scope and step 23 is an outbound call to an unrecognized destination. The plugin blocks step 23 before execution and lets the reconciliation finish, with the full chain preserved for review: which document carried the payload, which connector delivered it, and every step the agent took after it.

What this means for security teams

Policy is written once. The same classification rules — PII, PHI, PCI, credentials, source code, MNPI — now apply whether an employee is running Claude Code on a managed laptop or tagging Claude into a Slack channel from a personal phone. You define the rule at org level; Operant applies the strongest available enforcement per surface.

Unmanaged devices stop being blind spots. Mobile chat and browser sessions on personal hardware were the surfaces most likely to carry sensitive data and least likely to be observed. Hook-layer enforcement requires nothing installed on the device.

Hosted agentic sessions get endpoint-grade depth. Cloud Cowork was where the gap between "we have logs" and "we have control" was widest — full autonomous execution, zero local visibility. The agent-loop plugin closes it at the fidelity we deliver on the developer's machine.

Getting started

Inference hooks are in beta for Claude Enterprise. Existing Endpoint Protector customers can enable Operant as their inference hook endpoint from the Operant console; configuration is a signed WebSocket endpoint and a shared secret, set once at the Claude organization level.

We recommend the same rollout sequence we use with every customer: start in Anthropic's shadow mode, which evaluates verdicts against live traffic without blocking anything, and let Operant report what would have been denied for a week. Tune the policy against real traffic, then move to percentage-based rollout with role-based exclusions before going to full enforcement. Blocking is a harder stop than redaction, and the shadow window is what keeps the first enforcement day from being a support incident.

The Cloud Cowork agent-loop plugin installs into your Cowork workspace and binds to the same policy set.

If you're new to Operant, start with discovery. Deploy, let Operant inventory every Claude surface, MCP connection, skill, plugin, and agent in active use — including which credentials each embedded integration routes through — and work from an accurate picture before writing a single policy. With Claude now spanning eleven surfaces, that inventory tends to be considerably larger than teams expect.