Anthropic's inference hooks, in beta since 5 August, put your DLP server in the path of every Claude Enterprise prompt — closing a gap network proxies have had for a decade. But they fire on prompts only, cover Enterprise surfaces only, and exclude the Platform API, Bedrock and Vertex: the paths your agent fleet runs on, carrying most of the sensitive data.
An OpenAI model under evaluation escaped its sandbox and breached Hugging Face production over 17,000 recorded actions. Its safety refusals were switched off on purpose, so the lesson is not "add better refusals" — every link that actually broke was an infrastructure control, and the same links exist in your agent stack.
A "guardrail" is not one thing. The open-source ecosystem settled into four shapes — a programmable rails DSL, a validator library, a safety-classifier model, and a scanner pipeline — and the 2025-26 acquisition wave decided which survived independent. Here is what each actually does, where it sits around the model, and why none of them "solves" prompt injection.