Claude's early-August 2026 enterprise stack: Cowork Chrome, Compliance API, Auto mode, and self-hosted runners as one playbook

Introduction

I stopped reading Anthropic's early-August posts as separate product news. Cowork in the Chrome side panel, Compliance API coverage for session transcripts, Auto mode as a default, self-hosted runners, and inference hooks are one stack. If you enable the user-facing pieces without the export and DLP pieces, you get faster agents and a thinner audit trail. That is the opposite of what I want on an enterprise engagement.

This post is the playbook I use when a Team or Enterprise admin asks what to turn on this week. I start from the risk surface (browser Cowork), then the autonomy dial (Auto mode), then the inspection plane (inference hooks and Compliance API), then where sessions actually run (self-hosted runners). Week 32's cross-session messaging sits at the bottom as a coordination primitive, not a governance control.

If you already run knowledge-work agents, pair this with the Cowork mobile/web playbook. If you already argue about approval prompts versus classifiers, keep governing agent autonomy open in another tab. Same dial, different product surface.

The five releases as one coherent stack

Here is the week in order, with the decision each release forces.

Aug 12: Chrome side panel becomes Claude Cowork

Anthropic's Cowork Chrome side panel post is the user-visible change. The Chrome side panel is now Claude Cowork: shared sessions, skills, and connectors in the browser. Max and Team get it today. Pro is rolling. Enterprise is off by default and gated behind admin domain allowlists.

That last sentence is the one I care about. Browser agents with connectors are a different risk class from a terminal coding agent. The page context is untrusted. The connector can be trusted. Prompt injection sits between them. Anthropic is treating prompt injection as a first-class concern here, which matches how I already brief clients: the model will try to follow instructions it finds in the page. Your job is to bound what those instructions can reach.

Automatic approve and the consequential-action check

Cowork Chrome pairs throughput with a consequential-action check. Low-stakes actions can auto-approve. High-stakes actions still need a human. That is the same autonomy dial I described for Cursor Auto-review in governing agent autonomy. It is not a hard security boundary. It is a fatigue reducer with an escalation path.

• Keep Enterprise Cowork off until domain allowlists exist in writing, not in a Slack thread.
• Scope connectors the same way you scope OAuth apps: least privilege, named owners, revoke path.
• Assume page content can instruct the agent. Design for that, do not argue with it.
• Shared sessions are a collaboration feature and an audit surface. Decide who can join before you celebrate the demo.

Aug 11: Compliance API beta extends to Cowork and Claude Code

The Compliance API Cowork and Claude Code post is the export half of the stack. The beta now covers Cowork and Claude Code session transcripts. You use the same Compliance Access Key you already have for Compliance API. That continuity matters. I do not want a second credential scheme for the same retention policy.

What it excludes is as important as what it includes. Code on web, Platform, Bedrock, Vertex, and Foundry stay out of this expansion. If your production agents run on Bedrock or Vertex, do not pretend this Compliance API update closed your transcript gap. It closed the Cowork and Claude Code session gap for customers already on Compliance API.

• Map which seats produce Cowork and Claude Code sessions you must retain.
• Confirm the Compliance Access Key path works end to end before enabling Cowork Chrome for those seats.
• Document the exclusions: web Code, Platform, Bedrock, Vertex, Foundry need a separate retention story.
• Treat transcript export as a control, not a nice-to-have for legal after an incident.

Aug 7 / Aug 14: Auto mode becomes the default

Anthropic's Auto mode default post sets the date: Auto mode becomes the default on August 14 for Pro, Max, and Team. Classifier tokens are free on those plans. Enterprise, API, Bedrock, Agent Platform, and Foundry stay opt-in. That split is correct. Defaults should follow where humans already accept more autonomy. Enterprise should stay explicit.

The numbers Anthropic published are useful if you read them as product evidence, not as a security proof. In a tester study, humans caught about 14% of planted dangerous commands versus about 89% for Auto mode. Teams and Enterprise adopters shipped about 25% more PRs. I take both as signals that classifier gates beat prompt fatigue for routine work. I do not take them as permission to drop tool allowlists, secret scanning, or egress controls.

How I place Auto mode in the autonomy dial

Auto mode is a consequential-action classifier in front of tool use. Same family as Cursor Auto-review. Same failure mode: non-deterministic miss in either direction. I turn it on for trusted repos and read-heavy workflows. I keep Enterprise opt-in until the org can answer three questions: which actions always escalate, who owns a false allow, and how transcripts get reviewed after the fact.

• Pro/Max/Team: expect the Aug 14 default. Brief users before the flip so they do not disable it out of surprise.
• Enterprise: stay opt-in. Pilot on a named team with written escalation rules.
• API / Bedrock / Agent Platform / Foundry: still opt-in. Do not invent a default that Anthropic did not ship.
• Pair Auto mode with the same eval hygiene I use for offensive agents in the sandbox escape checklist. Classifier confidence is not egress proof.

Aug 6: Self-hosted environments public beta

The self-hosted Claude Code sessions post is about where the runner lives, not where the model lives. Team and Enterprise get a public beta: runners in your network, inference still to Anthropic. Off by default. Unavailable with Zero Data Retention.

I see teams misread this as "Claude runs fully inside our VPC." It does not. Your tools and session compute can sit closer to your code and secrets. Model inference still leaves. If your security review assumed ZDR plus self-hosted equals air-gapped Claude, rewrite the review. Self-hosted and ZDR are incompatible in this beta. Pick the constraint that actually matters for your threat model, then design around it.

• Use self-hosted when tool access to private networks is the bottleneck, not when you need inference isolation.
• Keep it off until network path, secret injection, and runner identity are owned by platform, not by a single power user.
• If ZDR is non-negotiable, do not plan a self-hosted pilot on this beta. You will waste a sprint.
• Log which sessions ran on self-hosted runners so Compliance API export and ops debug tell the same story.

Aug 5: Inference hooks for Enterprise DLP

Inference hooks beta, covered in Anthropic's enterprise inference hooks post, is the inspection plane I want before browser Cowork goes wide. Hooks can look at prompts and tool responses for DLP. Shadow mode and percentage rollouts are built in. That is the right rollout shape: observe first, block second.

I treat hooks as policy enforcement at the model boundary, not as a replacement for connector allowlists. A hook that redacts a secret in a tool response still means the tool was called. Prefer not calling the tool. Use hooks for the cases where the model already saw something it should not ship onward.

1. 01
   Stand up shadow mode on a single business unit

   Log would-block decisions without blocking. Measure false positives on real prompts for a week.
2. 02
   Define block classes that security owns

   Secrets, regulated customer data, and production credentials first. Do not start with style nits.
3. 03
   Percentage rollout, then full block

   Move from shadow to 10%, then 50%, then 100% on the same policy. Change one variable at a time.
4. 04
   Only then widen Cowork Chrome

   Browser connectors without hooks is how DLP becomes a retrospective email. Hooks first, side panel second.

Week 32 note: cross-session messaging as coordination

Claude Code Week 32 adds cross-session messaging primitives (`ListAgents` / `SendMessage`) documented in the 2026 week 32 what's new notes. I mention them here because multi-agent coordination without a message bus is how teams reinvent brittle file drops. Treat messaging as a coordination primitive. It is not a compliance control and it does not replace Auto mode, hooks, or export.

If you are already tracking Claude Code weekly surface area, fold this into the same checklist as Week 29 artifacts and MCP connectors. Capabilities accrue. Governance has to accrue with them.

Enterprise vs Team: rollout steps I actually run

Team and Enterprise should not share the same enablement order. Team can chase throughput sooner. Enterprise should chase evidence sooner.

Team rollout checklist

1. 01
   Brief on Auto mode before Aug 14

   Explain the consequential-action check. Tell people not to disable it out of surprise. Collect one week of "false escalate" reports.
2. 02
   Enable Cowork Chrome for a pilot group

   Max/Team seats with a short connector list. No CRM write access on day one.
3. 03
   Confirm Compliance API export for pilot sessions

   Same Compliance Access Key. Prove you can pull a transcript before you widen the pilot.
4. 04
   Optional self-hosted runner for private-repo work

   Only if ZDR is not required and platform owns the runner identity.
5. 05
   Widen connectors after one quiet week

   Add connectors one at a time. Keep a revoke owner named in the runbook.

Enterprise rollout checklist

1. 01
   Leave Cowork Chrome and Auto mode off/opt-in

   Write domain allowlists and escalation rules first. Defaults are not your friends on regulated seats.
2. 02
   Shadow inference hooks for seven days

   DLP classes owned by security. No blocking until false-positive rate is tolerable.
3. 03
   Prove Compliance API transcript export

   Cowork and Claude Code paths. Document Bedrock/Vertex/Foundry exclusions in the same policy page.
4. 04
   Decide self-hosted vs ZDR explicitly

   Pick one. Record the decision. Do not pilot both assumptions in parallel.
5. 05
   Pilot Auto mode on a named team

   Opt-in only. Compare interrupt rate and incident rate against the control group.
6. 06
   Enable Cowork Chrome behind allowlists

   Last step, not first. Shared sessions and connectors only after hooks and export are live.

What I would not do with this stack

• I would not treat Auto mode catch rates as a substitute for egress proofs on eval environments.
• I would not enable Enterprise Cowork without domain allowlists and a connector owner.
• I would not claim "self-hosted Claude" when inference still leaves the network.
• I would not assume Compliance API now covers Bedrock, Vertex, Foundry, Platform, or Code on web.
• I would not skip Week 32 messaging policy if agents can already talk across sessions. Coordination without ownership creates quiet lateral movement.

Conclusion

Early August gave Anthropic customers a real enterprise control plane if they wire it in order. Browser Cowork raises the risk surface. Auto mode raises throughput. Inference hooks and Compliance API make the work inspectable. Self-hosted runners move compute closer to your network without pretending inference is local. Team can move faster. Enterprise should move in evidence order. That is the whole playbook.

Sources: Cowork Chrome side panel at Claude blog ; Compliance API for Cowork and Claude Code at Claude blog ; Auto mode default at Claude blog ; self-hosted runners at Claude blog ; inference hooks at Claude blog ; Week 32 notes at Claude blog .