Good News: Anthropic Made Claude More Secure. Bad News: That's Not Enough.

Let me start with the good news. Anthropic has done something most AI platform vendors haven't. They shipped real security infrastructure, and they've been transparent about how it works.

Claude Enterprise brings audit logs, SCIM provisioning, custom data retention controls, a Compliance API for programmatic access to activity logs and chat histories, and connectors into the workplace tools enterprises already run like Google Drive, GitHub, Microsoft 365, Slack. HIPAA readiness and a BAA are available for regulated industries.

Claude Code Security, launched in February, goes further than most security tooling in its category. Rather than scanning for known vulnerability patterns, it reads and reasons about code the way a human security researcher would by tracing how data moves through an application and catching context-dependent vulnerabilities that rule-based tools miss. Nothing gets applied without human approval. Every finding comes with a confidence rating. That's a meaningful design choice.

Then there's Claude Managed Agents, now in public beta. The architecture here is worth understanding in detail because it represents genuine security thinking. The platform decouples three components — a session log, a harness, and a sandbox — specifically so that security tokens are never reachable from the environment where Claude's generated code runs. OAuth tokens live in a secure vault. When Claude calls an MCP tool, a dedicated proxy fetches the credential and makes the call. The agent itself never handles the token. The harness never sees the credentials. That is not security theater. That is a considered architectural decision.

For a platform vendor, this is a serious posture. Most of their competitors aren't close.

So yes. The good news is real. Security teams deploying Claude Enterprise have more controls than they did six months ago, and Anthropic has earned the acknowledgment.

Now for the bad news.

Two different problems wearing the same name

When most people say "AI security," they mean one of two things without realizing they're different problems.

The first is platform security. This is what Anthropic is solving. It covers the front end: how users authenticate, what permissions they're granted, how the model handles data within its own boundaries, what administrators can configure and audit. These are the right things to secure at the platform level.

The second is ecosystem security. This is what most organizations still don't have. It covers the integration layer: what AI agents actually do once they're live and connected to enterprise systems. Backend API traffic. OAuth tokens authorizing persistent access across SaaS applications. AI-driven workflows moving sensitive data between systems with no human in the loop. App-to-app data flows that no one explicitly approved. Autonomous agent actions executing across a CRM, a data warehouse, an HR platform, and a code repository simultaneously.

The Managed Agents architecture illustrates the boundary precisely. The proxy fetches the credential and makes the call to the external service. Anthropic's visibility covers that call leaving the platform. It does not cover what happens on the other side: which records were accessed, what was written, how that data now moves across other connected systems, whether that MCP server has been compromised, whether the downstream application is behaving consistently with its baseline.

The gap is structural, not a flaw in Anthropic's design. It is the nature of where platform security ends and ecosystem security begins.

What the data says

In January and February of this year, we surveyed 500 U.S. CISOs about their security capabilities and the incidents they experienced in 2025. The pattern was consistent across every sector and company size we examined.

"1 in 3 enterprises experienced suspicious AI agent activity in 2025 — Year One of serious enterprise AI deployment."

89.2% of CISOs claim strong or comprehensive OAuth token governance, yet 27.4% were breached through compromised OAuth tokens.

77% claim comprehensive behavioral monitoring with data-layer context, but 30.8% experienced unauthorized SaaS-to-AI data exfiltration anyway.

78.6% claim a comprehensive, real-time data flow map across SaaS and AI, but 86.8% cannot see what data AI tools are exchanging with SaaS applications.

These contradictions point to the same structural problem. The tools most organizations rely on were built to govern access, not to control what happens after access is used. More spending in the same tool categories will not close a coverage gap those categories were never designed to address.

What happens when the integration layer goes unmonitored

In March 2026, a Vercel employee connected their enterprise Google Workspace account to Context.ai, an agentic AI tool, and granted it broad permissions. When Context.ai's AWS environment was compromised, the attacker used that OAuth token to access the employee's Google Workspace and move into Vercel's internal environments. No new login. No MFA prompt. A legitimate, already-authorized token doing exactly what it was built to do.

Vercel had no visibility into Context.ai's infrastructure. There was no signal until the attacker was already inside. The blast radius started with a Chrome extension a single employee installed months earlier.

In April, ShinyHunters breached Anodot, an AI analytics integration provider, and walked out with authentication tokens giving them access to dozens of Snowflake customer environments downstream. Rockstar Games was the first named victim — 78.6 million records claimed. Snowflake's product was never compromised. The attack didn't need it to be. It only needed the integration layer sitting in front of it.

Both incidents happened in 2026, after Claude Enterprise launched, after Claude Code Security shipped. Both came through the integration layer through the OAuth tokens and third-party integrations that connect platforms to everything else in the enterprise. Runtime enforcement at that layer, between the agent and the systems it connects to, is the only position from which either attack could have been stopped before it completed.

Securing the integration layer is a runtime enforcement problem

The question is no longer only what the configuration allows. It is what is actually happening, across every connected system, at any given moment.

That means knowing which AI agents are active and what SaaS systems they can reach. Which OAuth tokens are live, what scope they carry, and whether they are behaving consistently with their intended purpose. What data is moving between which systems through which integrations. Whether non-human identity behavior matches its established baseline. And when something goes wrong, being able to reconstruct the full chain of events across every connected system in minutes rather than days.

No AI platform vendor can solve this from inside their own boundary. It requires a layer that sits across the ecosystem; one that inspects agent actions before they execute and can block, mask, or restrict writes at the protocol level, regardless of what the model decides to do. That is what Vorlon Guardian is built for.

The AI platforms are becoming more secure. The ecosystem they connect to is not.