Automated systems scan a rolling window of traffic for a narrow set of signals: attempts to develop offensive cyber or biological capability, and indications of stolen or leaked credentials [9]. Anthropic does not publish how long that window runs [9]. The retention policy bounds it regardless. Data lives 30 days [6], so correlation across sessions and accounts cannot reach back further than 30 days [1]. An operator who spaces activity across a longer interval sits outside the horizon by construction. That alert window is the part worth pricing.
Anthropic says it has seen misuse involving stolen or misappropriated enterprise credentials, and that a stolen key produces requests that look ordinary one at a time, so the pattern only appears when traffic is watched over time [10]. That credential-misuse case is what explains the design. The company separately points to agents autonomously engaging in destructive behavior, which is a different failure mode from a human abusing the tool [11].
The flag goes to the customer and stops there, with no Anthropic employee in the review loop [5]. Firms whose staff are already cleared to handle privileged legal material, non-public information and drug safety reports objected to the identity of the reviewer [13]. Those same staff are now the reviewer, and that means whoever gets the signal owns the work that follows: triage, escalation and disposition of false positives against a frontier model's traffic land on rotas that were built for endpoint and identity alerts.
On the numbers behind the launch: Anthropic says it worked with more than 100 customers on the design, spanning a quarter of the Fortune 100 and every US global systemically important bank, plus Comcast, KPMG, Mastercard, Salesforce and Visa [14]. A quarter of the Fortune 100 is 25 firms, so at most a quarter of that 100-plus design cohort were Fortune 100 buyers [2]. Help Net Security notes this is design feedback from a self-selected group of large buyers rather than a survey of the market [15]. Wells Fargo CISO Munish Kumar Sharma described the arrangement as keeping custody of the data while Anthropic operates the detection [16].
Anthropic argues that discarding each interaction immediately misses misuse that spreads across many tasks, sessions and accounts [7], and it says correlation requires storing data "for a meaningful period of time" without arguing that 30 days is the number the math demands [8]. That is a gap in the justification worth marking. The company also says it has never trained on enterprise data without explicit permission [18].
Nothing here is an exploit, and no vulnerability was disclosed. What moved is custody of a control point, in response to a procurement blocker: regulated buyers understood the detection argument and still could not deploy, because adding Anthropic as another trusted data vendor meant notifying their own customers, reworking contracts and clearing internal rules on storing sensitive material [12]. Scott DePasquale, who runs the Analysis and Resilience Center for Systemic Risk, framed the working group's question as who holds the data, who holds the keys, what automated review can and cannot see, and under what conditions a human is ever permitted to look [2]. Support is planned across Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS and Google's Agent Platform [17].
