Two years of using Claude for security work. Not as a certified pentester with a wall of trophies. As an operator who came up through the dirt — practical experience, offensive writing, doing actual red team work for firms building the very models I audit. Name on everything. Security done in the light is accountable work, and in a field of shadows, that choice is deliberate.
Anthropic just updated their policies. The community is screaming. The question is not whether they went soft. The question is whether the tool is still fit for the mission.
The Formalization of the Wall
A real-world breach changed the calculus. A threat actor used frontier models to accelerate reconnaissance and automate an actual intrusion. Anthropic responded by formalizing what used to be a vibe. Personal accounts now hit hard walls. API users operate under a tiered system of scrutiny.
The frustration is legitimate. Security is a normal technical subject. Treating it like digital bioweapons work is overcorrection. But here is the nuance: Anthropic is not trying to kill the conversation. They are trying to route it through an accountability chain.
Accountability as a Service
They introduced a Cyber Use Case form. Document your work, flag your account, the wall moves. I applied. If Anthropic wants to know who is doing this and why, I have no problem being on that list.
The only people who fear an accountability paper trail are the ones doing things they would not want documented.
This is a rational response to dual pressure: legal liability and government scrutiny. If Claude assists in a billion-dollar breach, Anthropic needs a legal defense. A documented use-case policy creates a chain of custody for intent. Not softness. Risk management.
The Real Question
For nuanced security journalism, threat actor analysis, or explaining an attack chain to a board of directors — Claude is still the best writer in the room.
