A Product in Spring, a Line Item in Summer

I never got comfortable running Claude Code sessions inside Anthropic's cloud. The prompts and the context were already going over the wire, and handing over full copies of the repository, the build artifacts, and whatever secrets a session touches felt like paying twice for the same trip. So I worked around it. I left sessions running against my own hardware with Remote Control, operating on my own files, on a device I owned. It worked, and it stopped exactly where I did: my session, my account, nothing I could hand to a team. Two recent announcements from Anthropic move that line, and both of them landed on me the same way. The capability I would have evaluated as a product a few months ago now ships as a line item on the platform.

The AI Gateway Was Always a Feature

I keep landing in the same argument about AI security startups: the good ones have a feature, and that feature belongs inside something the customer already owns. Lasso is the example I reach for. An AI gateway that intercepts LLM calls, judges them against policy, and blocks the ones that leak is a good capability. Palo Alto and Checkpoint have been intercepting and inspecting HTTPS traffic for decades, and nothing was stopping them from applying the same checks to a call headed for a model. I expected the firewall vendors to close that gap.

Anthropic closed it from the other side. Inference hooks route every inference request through a signed WebSocket to a security server the customer runs. Before the model starts generating, Claude sends the prompt and its surrounding context over, the server returns allow or deny, and generation waits on the verdict. It covers Claude chat, Claude Code, Claude Cowork, and tool calls made through MCP connectors, skills, and plugins. There is a shadow mode for testing, role-based exclusions, percentage rollouts, and configurable timeout and failure behavior.

Netskope, Palo Alto Networks, Proofpoint, and Zscaler are listed as integrations at launch. That is the part I did not predict. For 20 years the security question was where to put the inspection point, and the answer was always somewhere I controlled: the edge, the proxy, the CASB. Enterprise customers now get a better guard shack than most of them would have built, and it sits on Anthropic's property with the DLP vendors checking in at the window.

The Artifacts Come Home. The Conversation Still Leaves.

The second announcement is self-hosted environments, in public beta for Team and Enterprise. A runner is a long-lived process on customer infrastructure that picks up sessions and starts a Claude Code process for each one, either as a fixed pool or started on demand by an orchestrator. Repository checkouts, build artifacts, secrets, and any file a session creates or modifies stay on the customer's side of the fence.

The conversation still leaves. Prompts, responses, and tool results travel to Anthropic for inference, and the transcript is stored so a session can be resumed from any surface. That boundary means nobody is getting out of trusting Anthropic with the content here. What changes is that Anthropic no longer needs a full copy of the project to do the work, and that completeness on disk was always the part that bothered me.

It also fixes the ceiling I hit with Remote Control. My workaround was mine, tied to my account and my machine. This is shared infrastructure a development team can point at, which is the version that survives contact with a real org. It is off by default, and it is not available to organizations using ZDR.

Both Are Welcome. Both Are Gravity.

Inference hooks are Enterprise only, and standing them up means DLP policy for AI traffic runs through an Anthropic integration. Self-hosted environments cost engineers; Anthropic's own post says to plan on staffing the build and ongoing maintenance of the runner image, the updates, and the orchestrator. Work already spent is the most durable retention mechanic there is. Add the reporting that Anthropic has started an in-house silicon team, and the direction is a single vendor owning the model, the inspection point, the runner spec, and the chip underneath all of it.

That is not an argument against either feature. I moved my sessions onto my own hardware because I wanted the artifacts on my side of the line, and both of these move the line where I wanted it to go. They also make it harder to redraw that line somewhere else later. I would turn both on, and I would write down what leaving costs before I did.

🤖 AIL LEVELS: This content's AI Influence Levels are AIL3 for the writing, and AIL4 for the images. AI Influence Level (AIL) framework