Auto Mode, Zero Retention, Continuous Scanning: What Anthropic's Fall Releases Mean for Security Teams

Anthropic's last two developer releases moved a set of security controls from "ask your account team" to generally available or public beta, and security teams evaluating agentic coding should re-run their assessments against this list. I've been running Claude Code agents across my own projects all year; here is what changed and what I'd look at first.

Autonomy is now gated by a classifier, not a human click

Auto mode became the default for Claude Code's Pro, Max, and Team plans on August 14, with Enterprise and the cloud platforms to follow. Every tool call passes a classifier tuned for irreversible, destructive, or external actions; blocked actions route to a safer path or a human.

Anthropic's published evaluation reports that human reviewers caught 13.6% of dangerous commands while auto mode blocked 89%, and that users approved 97% of the permission prompts they saw. That last number is the one I'd put in front of a risk committee: manual approval at that rate is closer to a habit than a control. Anthropic's own guidance still calls for manual review of high-stakes production changes. That's the right line, and it belongs in your policy, not only in the tool.

Zero data retention no longer means flying blind

Enterprise Frontier Safeguards, announced September 1, pairs zero data retention with automated misuse detection, keeping the monitoring data in the customer's own cloud storage under customer-managed keys. Flags go to the customer, and Anthropic says no human review by its employees is required.

For regulated industries — financial services, healthcare, legal, public sector — this removes the most common objection I hear: "we can't let the vendor keep our data, but we can't run without abuse detection either." Rollout is phased, with broad availability targeted for this fall.

Code review and vulnerability scanning are becoming continuous

Code Review reached general availability on October 15 for Team and Enterprise, with most reviews finishing in roughly 6–10 minutes instead of about 20, and a per-repository dial (Quick, Standard, Deep). Claude Security, in public beta for Enterprise since October 21, now scans continuously and tracks findings until the fix ships. The practical shift: review capacity no longer has to shrink as agents generate more code than people can read.

Agents are becoming observable and accountable

Three smaller items close gaps that usually show up in audits. Agent observability, in public beta since October 14, exports OpenTelemetry traces from managed agents, the Messages API, and the SDKs to whatever OTel tooling you already run. API keys in the Claude Console can now be tied to a named user or a service account, and they stop working when that identity is removed from the organization. And admin controls announced in July break usage and cost out by group, user, and model, with model defaults by role, spend limits by group, and threshold alerts.

What I'd do this quarter

1. Write the line between classifier-gated and human-gated actions into policy. Mine is simple: anything that publishes, sends, spends, merges, or deploys goes to a person, whatever mode the tool is in.
2. Re-inventory your API keys and move every one to a named owner or service account.
3. Pipe agent traces into your existing observability stack before you scale agent count, not after.
4. If data retention has blocked you, ask for the EFS timeline for your cloud.
5. Pilot Code Review on one repository at Standard, and compare its findings with your existing scanner for a month.

What I'll be watching: EFS general availability dates by cloud, and when auto mode becomes the default on Enterprise and the cloud marketplaces. That's the moment most enterprise fleets inherit these defaults, ready or not.

— Todd Carter, CISSP

Sources: Anthropic — auto mode, Enterprise Frontier Safeguards, Code Review GA, Claude Security continuous scanning, agent observability, API key types, and admin usage and spend controls.