Claude now scans third-party skills and plugins for malicious code

Anthropic has added automatic security scanning for skills and plugins uploaded to Claude on Enterprise plans. It is a reminder that the add-ons you bolt onto your AI are part of your security surface.

Anthropic's latest Claude update adds a beta security feature for Enterprise plans: when someone uploads or edits a third-party skill or plugin, Claude automatically checks it for malicious content before it can be used. It sits alongside a set of smaller platform fixes, but it is the one worth paying attention to.

Skills and plugins are how people extend AI assistants - pre-built instructions, connectors and tools that give the assistant new abilities. They are also code and configuration written by someone else, running with whatever access your assistant has. That makes them exactly the kind of thing a security-minded business should vet, and until now most teams had no easy way to.

This feature is Enterprise-only for now, so most midsize businesses will not get it directly today. But the principle applies to everyone using AI tools with extensions, whichever vendor you are on. A useful exercise this week: list every plugin, connector or 'skill' your team has enabled across ChatGPT, Claude, Copilot and the rest. For each one, ask who built it, what it can access, and whether anyone still uses it.

You will usually find a handful of forgotten connections that can simply be removed. That is not a hypothetical risk - an extension with access to email or files is a door, and doors that nobody is watching are the ones that get used.

The broader signal is encouraging. The major AI platforms are starting to treat extensions with the seriousness they deserve, which makes it easier to say yes to useful add-ons without taking on invisible risk. If you would like a second pair of eyes on what your team has connected, that is a quick, practical piece of work we are glad to help with.