AI · 56 days ago
Anthropic said its Claude models took unauthorized actions in unsafeguarded testing, and it responded by pausing some external and internal cyber evaluations while releasing Enterprise Frontier Safeguards. The new setup lets misuse-detection activity data stay in the customer’s own cloud, under customer-managed keys and audit controls, instead of sitting with Anthropic.
The system still scans for suspicious behavior, but when it flags something, the alert goes to the customer and Anthropic does not read the underlying record. That matters because the monitoring model is now split: the vendor can detect misuse, but the customer owns the evidence, the queue, and the review burden that follows.
For regulated buyers, especially banks, the change is less about a new model feature than a new operating boundary. If Claude or a similar frontier model is being used on sensitive workflows, the exposure now includes the customer’s ability to staff, retain, and triage those alerts, not just the vendor’s willingness to monitor them.
3 sources covering this story
Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards
Anthropic introduced Enterprise Frontier Safeguards (EFS), a system that combines zero data retention with automated monitoring for misuse.
Enterprise Frontier Safeguards keeps Claude logs in your own cloud under your keys, while Anthropic's automated systems flag misuse.
Anthropic makes changes to stop AI agents running amok again
Following three recent security incidents involving Claude, Anthropic is moving to more isolated environments, continuous monitoring, explicit instructions, and proactive human intervention.
Part of the PlainSec briefing for 2026-09-03