Skip to content
NewsProduct launch

Anthropic adds malware scanning for third-party Claude skills and plugins in Enterprise beta

· by Pondero Newsdesk

The short version

Claude Enterprise gained automatic malware scanning for third-party skills and plugins on August 6, 2026. The beta feature checks every new upload and every edit before the skill or plugin reaches any employee, at no added cost, and pairs with the inference hooks DLP system Anthropic launched one day earlier.

Anthropic adds malware scanning for third-party Claude skills and plugins in Enterprise beta

Enterprise teams that stalled Claude rollouts for lack of a plugin vetting workflow have a native option: Anthropic shipped automatic malware scanning for third-party skills and plugins to Claude Enterprise on August 6, 2026, per the official release notes. Every new upload and every edit triggers a scan before the skill or plugin reaches any employee, at no added cost to Enterprise plans. The scanner does not cover MCP connectors or Claude-generated tools, so teams relying on those paths still need separate controls.

What

The scanner checks for malicious content at the moment a member or owner uploads or installs a third-party skill or plugin. It returns one of three verdicts: pass, warn, or fail. Per Anthropic's documentation, most scans finish in one to two minutes; results are cached, so re-uploading an unchanged file returns a verdict almost immediately.

The feature is off by default. Organization owners enable it in Organization Settings under Skills. Once turned on, it applies to Claude, Claude Cowork, and Enterprise plugin marketplaces through a single configuration. Custom roles can further gate which roles have scanning access.

Several categories fall outside the scanner's scope, per the same documentation. Plugins installed before the setting was enabled keep running without interruption. Anything Claude generates itself falls under Claude's built-in safeguards, not the scanner. MCP-delivered tools follow the MCP trust model and are not covered. MCP servers and hooks are excluded as well. Organizations running CMEK, zero data retention, or HIPAA configurations install skills and plugins the same way as before.

Why it matters

For a security or IT administrator running Claude Enterprise, the scanner provides a concrete supply chain control point. Teams staging Claude rollouts until they had a way to vet external skills no longer need a separate workflow or manual review queue. The three-tier result set lets admins build approval workflows around warned items rather than treating every non-pass as a hard block.

The MCP server exclusion is the most significant gap. As enterprise teams extend Claude's reach through MCP connectors and Claude Code marketplace extensions, those paths bypass the scanner and fall to separate trust decisions made at the MCP level. Anthropic has not indicated when or whether MCP coverage will be added.

The feature arrived one day after Anthropic launched inference hooks, a separate beta that routes every employee prompt through the organization's own DLP server before Claude generates a response. Per Anthropic's inference hooks blog post, the two controls form complementary layers: plugin scanning governs what tools enter the Claude environment, and inference hooks govern what data employees send through those tools in real time. Security vendors already integrated with the inference hooks system include Netskope, Palo Alto Networks, Proofpoint, and Zscaler.

What to watch next

Anthropic has not published the criteria the scanner uses to distinguish pass, warn, and fail results, which limits how plugin developers can audit their own submissions. The two most likely expansion areas are MCP connector tools and Claude Code marketplace extensions. Whether the detection criteria are eventually published will determine how much confidence the enterprise market places in a pass result.

Sources