Claude, the essentials — edition of October 12, 2026
Anthropic opens a Cyber Mission for defenders, with free scans for open source
Anthropic launched a long-term cyber effort aimed at critical infrastructure and open-source software, and said that finding vulnerabilities is no longer the hard part. It also published a revised Usage Policy, which takes effect on November 12, and shipped three Claude Code releases focused on agent and hook controls.
- The Anthropic Cyber Mission starts with two programs: the Critical Infrastructure Defense Program and OSS Scanner, which offers open-source projects regular security scans from Anthropic's strongest models for free.
- Anthropic says Project Glasswing partners found many vulnerabilities but that this has not yet reduced cyber risk enough. Verifying, prioritizing and fixing the findings remains the difficult part.
- The 2026 Usage Policy takes effect on November 12. It consolidates rules on deceptive campaigns and fake accounts into one section and adds controls for Claude taking physical actions autonomously.
- Claude Managed Agents can now write dynamic workflows, in beta. A workflow is a program that runs many agents in phases.
- Claude Code 2.1.295 adds an option to block an action when a hook fails to start, times out or exits unexpectedly. Version 2.1.294 fixes hooks written as instructions that let through what they were meant to block.
A cyber effort built on the limits of vulnerability discovery
On October 8, Anthropic announced the Anthropic Cyber Mission, which it calls a long-term commitment to securing the systems everyone depends on, through tools, research and resources for defenders. It starts with two areas. The first is critical infrastructure: the operational technology behind power grids, water systems and transportation networks, plus government systems. The second is open-source software. Each has a first program. The Critical Infrastructure Defense Program brings frontier models, on-site engineers and threat research to the people who protect operational technology. OSS Scanner gives open-source projects regular security scans from Anthropic's strongest models, at no cost.
The reasoning Anthropic gives is as notable as the programs. It says frontier models can be misused to exploit vulnerabilities and run cyber operations, that state-sponsored adversaries have spent years gaining footholds in these systems, and that defenders have deep experience but severe resource shortages. It also assesses Project Glasswing candidly: partners uncovered many vulnerabilities, but the company says it has not yet achieved a sufficient reduction in cyber risk. In its words, finding vulnerabilities is easier than ever, while verifying, prioritizing and fixing them remains challenging. Earlier that week, it says, Project Glasswing was merged into an expanded Cyber Verification Program, which gives many more defenders access to its most capable models. Anthropic also published a separate post titled “Launching an opt-in vulnerability-finding service for open-source software”, and an OSS Scanner page labeled Frontier Red Team. The material available here carries only their titles.
Sources: Introducing the Anthropic Cyber Mission — Anthropic · OSS Scanner — Anthropic · Launching an opt-in vulnerability-finding service for open-source software — Anthropic
A revised Usage Policy and wider compliance access
Anthropic published its 2026 Usage Policy on October 8, effective November 12. It says most changes clarify existing rules. Its stated reason for the update is that Claude has taken on longer, more independent work, so the policy adds examples showing how the rules apply to those capabilities. It also draws on patterns of misuse in influence operations, weapons development and surveillance, which it documented in its latest threat intelligence report. The main structural change is a new section, “Do Not Engage in Deceptive Campaigns or Artificial Activity”. Rules on this topic were previously spread across the elections, fraud, privacy and disinformation sections, and the new section applies to political and commercial activity alike. It covers hiding who is behind a message, amplifying content through fake accounts or posts, and building tools and infrastructure for influence operations. The elections section is now narrower and targets the use of Claude to deceive voters or disrupt elections. Anthropic also says it clarified requirements for high-risk uses in health and finance, added controls for when Claude autonomously takes physical actions, and addressed abusive behavior toward its models.
On the administration side, the Compliance API chat endpoints now also return chats from the unified Claude experience. This is in beta for Claude Enterprise organizations and works with an existing Compliance Access Key. Two further Anthropic posts are in today's material only by title: “Investigating unintended model actions in our evaluations and internal use” and “Using Claude Science to produce the first complete map of the sky in UV light”. Their content was not provided, so this edition does not summarize their findings.
Sources: 2026 Usage Policy update — Anthropic · Compliance API release note (October 8, 2026) — Anthropic (release notes) · Investigating unintended model actions in our evaluations and internal use — Anthropic · Using Claude Science to produce the first complete map of the sky in UV light — Anthropic
Agents that write and run workflows
The October 9 API release notes announce dynamic workflows for Claude Managed Agents, in beta behind the managed-agents-2026-04-01 header. For work with many pieces, such as reviewing hundreds of documents, an agent can write a workflow. Anthropic defines a workflow as a program that runs many agents in phases. The agent therefore does not just call tools in sequence. It writes the program that organizes a larger group of agents.
Claude Code 2.1.296 adds controls around the same pattern. The new CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL setting runs every workflow agent on one model while other subagents keep theirs. A new autoCompactWindow field, available in subagent frontmatter and in --agents definitions, lets a subagent auto-compact earlier than the main conversation's window. The release also adds a code key to managed.policies[] in the Claude apps gateway. It carries the same settings as cli and is also applied in Claude Desktop's Code tab. Beside desktop, it turns on Claude Desktop's gateway mode.
Sources: Claude Managed Agents dynamic workflows (API release notes, October 9, 2026) — Anthropic (release notes) · Claude Code 2.1.296 — Claude Code (GitHub)
Claude Code tightens how hooks fail
Two Claude Code releases concern what happens when a hook does not behave as intended. Version 2.1.295 adds onFailure: "block" for command and HTTP hooks. With it, a hook that cannot start, times out or exits with an unexpected code blocks the action instead of letting it through. Version 2.1.294 fixes prompt and agent hooks written as instructions, such as “Block commands that...”, which were allowing what they should have blocked. It also improves how Stop and SubagentStop prompt hooks written as instructions, such as “Carry on if the build is broken”, are judged, so Claude is less likely to stop early.
Version 2.1.295 also adds smaller conveniences. It supports the Program Status Protocol (OSC 7501), so terminals that implement it can show whether Claude Code is working, waiting on the user or done. The /copy picker now includes quoted text, so a drafted message copies without its > markers.
Sources: Claude Code 2.1.295 — Claude Code (GitHub) · Claude Code 2.1.294 — Claude Code (GitHub)
This edition is an original synthesis written by Claude from aggregated news — Anthropic's own sources first (release notes, status, newsroom, research, engineering), then the press, Hacker News, Reddit and GitHub, under the editorial supervision of Héra SASU. Every fact links to its article, publisher named. See the live feed →
Claude News is published by Héra SASU. Independent media, not affiliated with Anthropic.