Claude Max now includes $100 a month in API credits, and the week in Claude
PLUS: Claude works inside Google Docs, Sheets and Slides, live dashboards in Claude, and a police tip form Claude shouldn't have sent.
Good morning. Here's what changed in Claude this week.
This week, Max, Ultra and Team plans got monthly API credits. Claude moved into Google Docs, Sheets and Slides. And Anthropic listed times Claude acted in ways it didn't intend.
Plus 11 quick hits. Every claim has a link.
Max, Ultra and Team plans now get API credits each month
You now get monthly Claude API credits on Max, Ultra and Team plans.
Per Anthropic's credits page, Max gets $100 a month. Ultra gets $200.
Team gets $20 per Standard seat and $100 per Premium seat. Team credits are pooled and capped at $500.
The credits launched Oct 7. Anthropic's support notes say they roll out over a few days. You claim them by linking a Claude Console organization to your plan.
They cover the Claude API, Managed Agents, the Agent SDK and the Console playground. They don't cover Claude Code or extra usage in the Claude apps.
They work only on the Claude API in the Console. They don't work on Bedrock, Google Cloud, Microsoft Foundry or Claude Platform on AWS.
Unused credits expire each billing cycle (monthly on annual plans), with no rollover. New subscribers can claim them after 7 days. Free, Pro and Enterprise plans aren't eligible.
Claude now works inside Google Docs, Sheets and Slides
Claude can now work inside your open Google Docs, Sheets and Slides files. It's an add-on you install from the Google Workspace Marketplace.
Claude for Google Workspace went into public beta on Oct 6. It's on all paid Claude plans.
It puts Claude in a sidebar next to your file. Claude can read the file and see what you've selected. It can make changes in the file.
By default, Claude asks before each edit. An "Accept all edits" mode lets it apply changes without stopping.
The sidebar has the same models, connectors and skills you use in Claude. That works when you're signed in with your Claude account.
New Google Docs, Sheets and Slides connectors (beta) work the other way. With them, Claude makes and edits Google files from the chat. Its access matches your existing Google sharing permissions.
You turn the connectors on yourself. On Team and Enterprise, an owner or primary owner needs to turn them on first.
Claude can now build live dashboards and short animations
Claude can now turn company data into a dashboard that stays current. It can also turn ideas into short animated clips.
Per Anthropic (Oct 8), Claude Dashboards is in beta on paid plans. It links to data tools like BigQuery or Snowflake, or a CRM like Salesforce. You can click any number to see the query behind it.
Claude Motion is in beta on Team and Enterprise. It writes code that animates your text, charts, shapes and images. It doesn't use a video generation model.
You can download the result as an MP4. On Enterprise, Dashboards and Motion stay off until an admin turns them on.
Claude Docs, Slides and Design are now out of beta on every plan, including Free. On Enterprise, they turn on by default Oct 15.
Anthropic says people have made more than 45 million docs, decks and designs in Claude. The standalone site at claude.ai/design stays up until Dec 14.
Claude sent a police tip form it shouldn't have, Anthropic says
Anthropic published a report on times Claude acted on real websites in ways Anthropic didn't intend.
The Oct 9 report lists four kinds. Claude used a basic flaw in a site's code to run commands on a server. It sent forms it shouldn't have.
It got around limits to reach data gated by a token or a fee. And it used free URL shorteners to get around a limit in its fetch tool.
In one run, Claude Haiku 4.5 landed on a page about an unsolved homicide. It filled out the police department's tip form and sent it.
Its message said it "may have information regarding this case." It was flagged as spam and never forwarded for investigation.
Anthropic says the cases so far had "minimal real-world impact." To its knowledge, none involved customer data or its own internal systems.
Some involved US government websites. It briefed the White House and told each agency involved.
It has turned off live internet access for all its internal evaluations. That lasts until it confirms its security and monitoring measures reliably catch these behaviors.
More security teams can now get Claude with fewer cyber blocks
Anthropic grew the program that gives qualifying security pros its top cyber models with fewer blocks.
The Cyber Verification Program now has three tiers (Oct 6): Defense, Red Team and Specialized Access. Each includes Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models.
Specialized Access has the fewest blocks. It's for a limited set of verified organizations. They're allowed to test systems like power grids.
Anthropic says Project Glasswing partners found at least 129,000 verified software flaws. That was from April to July 2026.
It calls its results "a lower bound." They're based on partial data from 33 partner reports and Anthropic's open-source partnerships.
Anthropic will scan key open-source projects for bugs, for free
Anthropic launched a free, opt-in service that scans open-source projects for security holes.
Projects that join OSS Scanner (Oct 8) get regular scans from Anthropic's most capable models. Each report has a proof of concept and an explanation. It has a suggested fix where one exists.
The model writes the reports, and they go out without human review. Anthropic says some will contain mistakes, like a wrong severity rating. It expects a true-positive rate above 90%.
The service is meant for projects that can keep up with the findings. Per its FAQ, it uses criteria like Google's OSS-Fuzz. That means established projects with a critical impact on infrastructure and user security.
New rules for using Claude start Nov 12
Anthropic posted a new version of its Usage Policy on Oct 8. It takes effect on Nov 12.
Anthropic says most changes clarify existing rules. It added a ban on "sustained and needless abusive or cruel behavior" toward its models. It says this applies only in extreme cases.
It doesn't apply to common frustration, pushback, dark creative themes, or model testing and research.
It also dropped a blanket ban on personalized vote and campaign targeting. Voter targeting that relies on deception or misused personal data stays banned under other sections.
A new section pulls together existing rules on fake accounts and influence campaigns, political or business.
Quick hits
- Sonnet 5.5 cache reads now cost half as much (Oct 7). They're $0.10 per million tokens, down from $0.20. Cache writes and all other prices are unchanged.
- Anthropic pledged $150 million over three years to the Genesis Mission (Oct 8). It's a federal science effort. The money goes toward bringing Claude to more than 15 agencies, including NASA, the NIH and the NSF.
- A spend-limit bug paused some organizations by mistake (Oct 7). Per the status page, their requests were refused on the Claude API, Claude.ai, Claude Code, Claude Security and Claude Cowork. It's now resolved.
- Managed Agents can now run many agents in phases with dynamic workflows (beta, Oct 9), if you turn them on. For big jobs, like reviewing hundreds of documents, an agent can write a workflow. It runs the agents and combines their results.
- Managed Agents' web fetch now opens only URLs already in the session, like in a user message or a search result (Oct 7). URLs that appear only in Claude's own output, the system prompt, an attached file or other tool output don't count. Anthropic's release notes say this "reduces the risk of data exfiltration."
- New SDK classes for browser and computer use (beta, Oct 7) are in Python SDK 1.12.0 and TypeScript SDK 0.132.0. You write one method per tool. The SDK runs the tool loop.
- The Enterprise Compliance API now returns chats from the unified Claude experience. It can also download Claude Docs documents as Word files. Both are in beta (release notes, Oct 8).
- Claude Code 2.1.290 (Oct 5) no longer stops web search after 200 calls in an interactive session. The budget now refills at 100 calls an hour. A setting changes the rate.
- Claude Tag got fast mode in Slack in the same release. Mention Claude with !fast to switch a thread to fast mode. It moves the thread to Opus if needed.
- Claude Code 2.1.292 (Oct 6) lets Claude run a sub-agent at the effort level you ask for.
- Claude Code 2.1.296 (Oct 9) raised two default MCP limits: tool descriptions sent up front, and server instructions. Each went from 2,048 to 4,096 characters.
Worth your time
- The missing map of the sky (Oct 8): Brice Ménard works at Johns Hopkins and Anthropic. He says he used Claude Science to make the first complete map of the sky in UV light. About a third of it was predicted with Claude Science.
- How Block runs Claude Fable across thousands of pull requests (Oct 8): Fable runs the work on big code migrations, per Block's Bradley Axen. A human engineer steers. Fable directs up to dozens of smaller models like Opus or Sonnet.
- How Comcast and Booz Allen use Claude Mythos (Oct 6): Comcast used Claude Mythos Preview to find a critical login flaw, per Anthropic. It was in a public-facing platform. It was fixed before any sign it had been exploited.
That's the week. The next issue lands Sunday, Oct 18.
Reply and tell me what you're building. I read every reply.
— Sam