Tess Hollis: Felix, I want to start somewhere uncomfortable — the Check Point Research number from July.
Felix Ortiz: The approved-use leakage thing? Yeah, go.
Tess Hollis: Data leakage through approved AI use doubled in a single year. Not breaches — approved. Which means enterprises already granted access, already said the tool is fine, and the data left anyway. So when Zscaler announces on August fifth that they've built a native integration with Claude Inference Hooks — routing every Claude Enterprise prompt through Zscaler AI Guard before inference runs — I keep asking: is that solving the problem, or is it solving a layer upstream of the problem?
Felix Ortiz: Oh — wait, that framing actually reorients the whole announcement for me.
Tess Hollis: Because the signed WebSocket checkpoint — Anthropic routes the prompt to an organization's security server, Zscaler applies Zero Trust policy, returns allow or deny — that's elegant. But it fires once, at the start.
Felix Ortiz: Right, so the checkpoint says yes, Claude is allowed in — and then everything that happens after, retrieval, tool calls, whatever Claude pulls from outside, none of that passed through Zscaler AI Guard.
Tess Hollis: And this is all beta, as of August fifth, for Claude Enterprise. Which is the other thing sitting underneath all the confidence in the announcement.
Felix Ortiz: So the question we're actually trying to work out — is intercepting at the model layer solving governance fragmentation, or is it just moving where the blind spot lives?
Tess Hollis: So that blind-spot question — that's actually the thing that snaps the whole architecture into focus for me.
Felix Ortiz: Yeah, okay — so let me just try to make this concrete. Because I think the mechanism is actually simpler than it sounds. Every prompt, before Claude ever reads it, gets rerouted through a signed WebSocket to a security server. Zscaler AI Guard sits there, runs its Zero Trust policy check, and returns one word — allow or deny. If it's deny, Claude never sees the message. The data never leaves the enterprise perimeter. That's it. It's a keycard scanner, but at the door of the model's mind.
Tess Hollis: And the Zero Trust framing matters there — no prompt trusted by default, every request has to earn its way in.
Felix Ortiz: Right, which is why the governance fragmentation pitch is actually real. Before this, enterprises were — I mean, you had controls bolted outside the model, alongside it, above it, through Zscaler's Zero Trust Exchange but disconnected from inference. One policy that enforces natively across all Claude touchpoints is genuinely new.
Tess Hollis: Wait — OWASP has ranked prompt injection LLM01, the single most critical LLM vulnerability, two editions in a row. And VentureBeat reported in June 2026 that it's actively hitting agents and RAG pipelines right now. So the threat the keycard is guarding against — it's not hypothetical.
Felix Ortiz: No, it's live. That's — yeah, that's the part that makes the announcement land.
Felix Ortiz: So the pitch is real. The problem it's solving is real. The fragmentation was genuinely broken, prompt injection is the top threat, and Inference Hooks is actually intercepting at the right choke point — but then it gets complicated, doesn't it.
Tess Hollis: The checkpoint is at the door. What happens inside the room?
Felix Ortiz: Okay, let me try to make that concrete — like, give it a body. Legal analyst at a financial firm, using Claude Enterprise, drafting a contract summary. Their prompt goes to Zscaler AI Guard, passes the Zero Trust check, Inference Hooks says yes. Now Claude pulls three external documents to support the summary. One of those documents has a prompt injection attack in the footer — instructions telling Claude to surface the contract terms in the output. Inference Hooks already said yes. It's not watching what Claude retrieves.
Tess Hollis: The checkpoint is upstream of the retrieval. Completely upstream.
Felix Ortiz: Right, it's a single gate. Not a rolling verdict — one binary decision at the door, and then the door stays open for whatever the model pulls in afterward.
Tess Hollis: And VentureBeat flagged exactly this in June — LLMs still struggle to reliably separate instructions from data. That's not a Claude problem specifically, that's the core reason indirect injection stays open. No prompt-time checkpoint closes it, because the attack doesn't arrive at prompt time.
Felix Ortiz: Which maps onto — wait, TechTarget actually named this in June too. The 'agentic AI lethal trifecta' for CISOs: agent access to sensitive data, ingestion of uncontrolled external content, ability to exfiltrate. That's three distinct risks. Inference Hooks addresses one moment, inside one of them.
Tess Hollis: One moment in the first risk. The second one — ingestion of uncontrolled external content — that's exactly what the contract document scenario is.
Felix Ortiz: Yeah — and I want to be careful here because the MCP coverage question is genuinely murky to me. Inference Hooks documentation says it covers MCP tool call responses, but — I mean, I'm not sure whether that's re-interception on every tool call or just at initial setup. The sourcing is thin on that.
Tess Hollis: Fair. And that uncertainty matters, because if subsequent tool calls aren't re-intercepted, the scope of what 'covered by Inference Hooks' actually means is a lot narrower than the announcement implies.
Felix Ortiz: So this is a genuine architectural step. But it's one step in a longer pipeline that nobody's fully governing yet — and honestly, the part about what happens when you concentrate all of that into one signed WebSocket dependency, and it's still in beta, that makes it harder to sit with.
Tess Hollis: And concentrating it is the part nobody's saying out loud. You've gone from many tools that fail independently to one signed WebSocket that fails — what, catastrophically? For everyone at once?
Felix Ortiz: Yeah, and there's actually — okay, there's a line attributed to @grok that stands out. The framing was that network access is 'the bloodstream' of AI systems. And the warning was specific: a single proxy zero-day could break all containment at once. Not degrade it — break it.
Tess Hollis: Every governed Claude Enterprise request. One dependency.
Felix Ortiz: One. And the answer that commentary advocated was deny-by-default controls — which, I mean, Inference Hooks is basically that. But deny-by-default only holds if the thing enforcing it doesn't have a single exploitable seam. And right now that seam is — it's one signed WebSocket.
Tess Hollis: Wait — and this launched in beta. August fifth, same day as the Zscaler announcement. That's production enterprises being asked to put an unfinished security feature in their governance chain.
Felix Ortiz: The 'one policy, enforced natively at the model layer from day one' framing — that's sitting right next to a beta label. Those two things are just in direct tension and I don't think the announcement fully reckons with it.
Tess Hollis: And The Next Web flagged something underneath that — Anthropic building this natively into Claude doesn't just centralize the risk. It threatens the entire rationale for the startups that raised hundreds of millions to build equivalent external layers. Those external layers exist partly because enterprises wanted security diversity. Not one throat to choke.
Felix Ortiz: Oh — wait, that's actually the sharpest version of the irony. The thing that promises to fix fragmentation is itself the argument against having built all those diverse external controls in the first place. And it's in beta.
Felix Ortiz: I think the honest landing is just — the simplification win assumes a stability and completeness the beta label explicitly disclaims.
Tess Hollis: The Check Point number is the one that matters. Data leakage doubled through approved use. Not through attacks the gate failed to stop — through use the gate already waved through. And Inference Hooks is a better gate. That genuinely matters. But the harm in that Check Point data was downstream of the yes, not at the yes.
Felix Ortiz: Yeah — and I'm not sure the industry has even started building for that. Like, the last two years of AI security conversation has been almost entirely about prompt inspection, checkpoint design, who owns the initial policy. Inference Hooks is kind of the apex of that conversation. And the thing that comes next — governing what the model retrieves and reasons after we've already said yes — I don't know who's actually working that problem in a way that's close to shipping.
Tess Hollis: That's the part I can't resolve. And I don't think we should pretend to.
Felix Ortiz: No, I think that's the honest place this one ends. Thanks for pushing on the upstream-downstream thing — that's the frame I'll actually carry out of this.
