Anthropic stripped filenames out of its enterprise audit log — retroactively, and the lookup that restores them dies with the file

The change, and the clause that makes it a story

Anthropic’s platform release notes for 24 September 2026 record it in three sentences:

The Compliance API Activity Feed no longer returns file names, project document names, or artifact titles. The filename and title fields on file, project document, and artifact activities are now always empty or omitted, including on activities recorded before this change. To look up a name or title by the ID on the activity, use a Compliance Access Key with the read:compliance_user_data scope.

Read past the first sentence. A vendor removing a field from new events is routine, and the Activity Feed documentation even tells you to expect it: “Pass through unrecognized type and actor.type values, and ignore fields your handler does not expect, so your integration keeps working when new activity types ship.” Forward-compatible handlers are the contract, and this change honours it.

The second sentence breaks a different contract. Including on activities recorded before this change. The reference page restates it with a date rather than a relative marker, which suggests it was written to be quoted: “As of September 24, 2026, the filename and title fields on these activities are always null, an empty string, or omitted, including on activities recorded before that date.”

Anthropic retains Activity Feed records for six years. It did not shorten that. What it shortened, to zero and backwards, is how long the record describes what it is a record of. An event from April 2026 that once read user X uploaded Q1_Restructure_Model.xlsx now reads user X uploaded claude_file_01UaT9wBcDfGhJkLmNpQrSv7. The row is intact. The noun is gone.

Start with the case for it, because there is one

The strongest argument for this change is one Anthropic never makes in the release note, and it is worth making on its behalf.

Filenames are content. Q3_Layoff_List_FINAL.xlsx, Project_Bluebird_DD_Redline_v7.docx, patient_cohort_2026_identified.csv — each leaks the substance of a document to anyone who can read the log, without their ever opening the file. And the Activity Feed is deliberately the low-privilege surface: it is the one Compliance API endpoint an Admin API key can reach, it is designed to be forwarded wholesale into Splunk or Sentinel or Cribl, and Anthropic’s own integration guidance assumes it lands in systems with broad read access across a security team.

So the pre-24-September design had a genuine flaw. A metadata-only feed, explicitly scoped to exclude content, was carrying a content-bearing field into third-party log stores. Anthropic’s integration page is otherwise careful about exactly this boundary — it lists at length what the Compliance API does not include, down to thinking blocks, system prompts of local sessions, and tool definitions. Filenames were inconsistent with that posture. Removing them is coherent.

The retroactive part is coherent too, on the same logic: if the field should never have been there, leaving it in five years of stored history perpetuates the leak for anyone who queries the archive later.

None of which resolves the problem, because the fix relocated the data behind a door that is heavier than the one it was taken from.

The recovery path costs more privilege than the log

The Compliance API has four scopes. Two matter here:

Anthropic’s setup page attaches an unusually direct warning to the second one:

A Compliance Access Key with read:compliance_user_data can read every chat, file, project, and session transcript in every linked organization, including content the primary owner has not seen. […] Treat Compliance Access Keys like production database credentials: store them in a secrets manager, never in source control or SIEM forwarder configuration.

Note the last clause, then note what the change asks you to do. To restore a filename to a SIEM record, your enrichment step needs the credential the documentation specifically tells you not to put near a SIEM forwarder. There is a clean way to do this — a broker service that holds the key, exposes only ID-to-name resolution, and logs its own access — but that is a service somebody has to build, staff and audit, in exchange for a string that used to arrive for free.

This inverts least-privilege rather than serving it. Before, the low-privilege pipeline saw names. Now the low-privilege pipeline sees nothing, and the only way to see anything is to hold a key that sees everything. There is no intermediate scope — no read:compliance_resource_names, no ID-resolution permission — and scopes are “immutable after creation,” so this is not a setting anyone can adjust at the edges. It is the same pattern this desk tracked when Anthropic put full life-sciences capability behind a verification programme with its own retention terms: the thing you want is available, and the price is a standing grant of access you would not otherwise have chosen.

For Console organisations, the door has no handle

The privilege upgrade at least exists for Claude Enterprise tenants. For standalone Claude Console organisations it does not exist at all.

Compliance Access Keys are created in claude.ai by a primary owner or organization owner, and the documentation states they are “available only to organizations that are part of a Claude Enterprise tenant.” A Console organisation uses an Admin API key instead, and the setup page is explicit about its ceiling: Admin API keys “cannot be granted any other Compliance API scope, so calls to any endpoint other than the Activity Feed return 403 Forbidden.”

So for that buyer segment, 24 September was not a change in how filenames are retrieved. It was the removal of filenames, permanently, from the only compliance surface available to them — with no programme to apply to and no scope to request. That is a tier difference that did not exist on 23 September, and it is the kind of thing that belongs in a procurement comparison rather than a changelog. Teams weighing Claude against ChatGPT for a regulated deployment now have a concrete asymmetry to write down: on the Claude side, audit-log resource naming is a Claude Enterprise feature.

The arithmetic that makes bulk enrichment impractical

Even with the right key, re-attaching names at scale runs into a budget the documentation states plainly.

The Activity Feed returns up to 5,000 records in a single request. The whole Compliance API is limited to 600 requests per minute per parent organization, and that ceiling is “shared across every key, every linked organization, and every /v1/compliance/* endpoint.”

The metadata endpoints resolve one ID per call. Files “do not paginate: they are retrieved individually by ID.” So a single feed page that costs one request to fetch can cost up to 5,000 requests to enrich — against a budget of 600 per minute that your ingestion loop is already drawing on. Enriching one full page could occupy more than eight minutes of the entire tenant’s compliance request budget, and that is before a second linked organisation’s pipeline asks for anything.

Not every activity is a file activity, so real ratios will be far kinder than the worst case. The shape still holds: ingestion is bulk and enrichment is per-object, and the two now share one meter. A pipeline that was comfortably inside its budget on 23 September can breach it on 24 September without a single line of code changing — the same class of silent, arithmetic-driven regression as the usage fields that stopped describing the bill after on-demand compaction shipped and the gateway field-drop that quietly changed what Claude Code charged for. A dropped field is rarely just a dropped field; it is usually a cost or a request moved somewhere less visible.

The failure mode nobody will see coming

Here is the one that should go into a runbook today.

Anthropic recommends deduplicating on the activity id field, and treating the feed as at-least-once delivery. Sensible advice, and most teams implement it as an upsert keyed on id. The integration guide also recommends a “periodic reconciliation pass that re-queries an older window” to catch late-indexed activities.

Put those two together after 24 September. A reconciliation pass over, say, March 2026 re-fetches activities whose filename you captured correctly at the time. They now come back with the field null. The upsert writes null over your good data. No error, no alert, no schema violation — a correctly implemented, well-tested pipeline methodically erasing the only remaining copy of evidence it collected months earlier.

Your archive is now the authoritative source for pre-24-September filenames. Anthropic’s copy is not. Any process that treats the vendor as the source of truth and your store as a cache has the relationship backwards for this one field, and will act on that mistake quietly.

What this does to the use cases Anthropic names for the feed

The Compliance API documentation names its own use cases: “eDiscovery (electronic discovery) exports, data loss prevention (DLP) enforcement, and account-deletion responses.” Two of the three lean on resource names.

DLP. Rules that match document naming conventions — an extension allowlist, a regex for *_PII_*, an alert on anything containing board or cohort — now evaluate an empty string. They do not throw. They stop matching, and a detection that stops matching looks exactly like a threat that stopped happening. Meanwhile the documentation’s own DLP guidance — “If a workflow might issue a Compliance API hard-delete (for example, DLP enforcement), retrieve and archive the target content first. There is no recovery window after a hard-delete” — now carries a second meaning: archive the name first too, because the hard-delete takes that with it.

eDiscovery. A custodian’s activity timeline is producible; a timeline of opaque IDs is substantially less useful to a reviewer, and resolving it requires the names to still be resolvable, which requires the documents to still exist — an assumption litigation holds exist precisely to stop anyone making.

The SIEM correlation table on the integration page is quietly revealing about the new shape. Every join key it offers is about the actor: actor.user_id, actor.email_address, actor.ip_address, actor.user_agent, plus created_at. Not one is about the object. The feed was already better at telling you who did something than what they did it to. As of 24 September it is decisively so.

The structural read

Anthropic’s enterprise controls have been getting materially better through 2026 — self-hosted Claude Code environments, session transcript capture across Cowork and the Microsoft 365 surfaces, zero-data-retention configurations of the kind OpenAI matched in August. The same 24 September release note that removed filenames also took the local-session endpoints out of beta for Excel, PowerPoint, Word and Outlook. This is a platform investing in compliance surface, not neglecting it.

Which is what makes the handling of this specific change worth naming. It shipped in the same release note as the refusal-billing change, as the third bullet of three. It was disclosed on the day, written into the reference docs with a dated sentence, and given a documented workaround — genuinely above the industry baseline for a breaking change. But it was classified as a schema note when the retroactive clause makes it an evidence-integrity event, and the privacy rationale that would have justified it was never stated, leaving readers to reconstruct it.

The pattern across this desk’s 2026 coverage keeps recurring in different costumes. A credential that turns out to be a session. A discount that turns out to be a default. And now a six-year retention commitment that turns out to cover the row but not the noun inside it. In each case the vendor documented the thing accurately and filed it under the wrong heading, and the buyer’s job was to notice that the heading was load-bearing.

What to do

Freeze reconciliation passes over pre-24-September windows until you have read your write path. If your ingester upserts on activity id, it will overwrite captured filenames with nulls on the next backfill. This is the only item here with a deadline, because the damage is cumulative and silent. Confirm the behaviour, then either stop re-walking old windows or make the writer refuse to replace a non-empty name with an empty one.

Grep your detection content for filename and title. Any DLP rule, saved search, dashboard panel or alert keyed on those fields in Activity Feed events is now dead code that reports healthy. This is a one-hour audit for most teams and it is the difference between a control and the appearance of one — the same discipline any developer needs when a provider changes a response shape without changing a status code.

Decide about read:compliance_user_data deliberately, and default to declining. Weigh a filename in a log line against a standing credential that reads every chat and session transcript in every linked organisation. For most organisations, nameless activity records are the better risk position, and “we chose not to hold that key” is a defensible answer to an auditor in a way that “it was in the forwarder config” is not. If you do need enrichment, resolve names at ingestion time rather than query time — they are only resolvable while the object is alive — and put the key behind a broker that logs its own use via compliance_api_accessed activities.

Re-derive your retention plan from the five horizons, not from the six-year headline. Activity records last six years under Anthropic’s control; content lasts as long as your claude.ai policy or until a user deletes it, whichever comes first. The names live with the content, not with the records. Anything whose audit horizon is longer than your content retention needs to be exported with its names attached, on the way in. Teams standardising on Claude or Claude Code for regulated work should treat that export as part of the deployment, not a later hardening step.

Ask your account team for an ID-resolution scope. The missing piece is small and obviously useful: a permission that resolves claude_file_* to a name and grants nothing else. It would restore the audit trail without handing anyone the tenant’s content. It does not exist today, and the people most likely to get it built are the enterprise buyers who ask for it during a renewal.

Questions or corrections? Email Pick Right. Want the full list? See all news.