Claude Weekly: Opus 4.7 Lands, Claude Design Launches, and MCP's First Security Reckoning

Claude Opus 4.7 went generally available this week, delivering substantial improvements in agentic coding, vision resolution, and reasoning control. But the bigger story is the simultaneous launch of Claude Design, the controversial removal of Claude Code from the Pro plan, and the first serious enterprise security test for the Model Context Protocol. Anthropic’s revenue doubled to $30 billion in annualized run rate, the Claude Platform is coming directly inside AWS, and Sonnet 4 / Opus 4 deprecation is now just weeks away. Below is the full enterprise brief for the week of April 16 to 23, 2026.

In a hurry? The takeaways: (1) migrate to Opus 4.7 or Sonnet 4.6 before June 15, (2) rebudget for the new tokenizer, (3) audit your MCP supply chain, (4) evaluate Claude Design for internal visual work, and (5) plan for Claude Platform on AWS. Skip to What to Watch or book a discovery call to turn these changes into a concrete rollout plan.

Claude Opus 4.7: A Meaningful Step Forward

Anthropic’s new flagship, Claude Opus 4.7, shipped April 16 with four upgrades worth flagging for technical teams evaluating it against Opus 4.6.

Vision resolution increased 300% to 3.75 megapixels (2,576px on the long edge) — up from Opus 4.6’s 1.15 MP. On the XBOW visual-acuity benchmark, Opus 4.7 scored 98.5% versus Opus 4.6’s 54.5%. For enterprise document processing, diagram parsing, and visual analytics workflows, this closes the gap with multimodal competitors.

A new xhigh effort level adds granularity between the existing high and max options, giving developers tighter control over the reasoning-versus-latency tradeoff. Claude Code’s default effort is now set to xhigh. Combined with task budgets (public beta) — a task_budget parameter that caps total token expenditure across entire multi-step agentic loops — teams can deploy agentic workflows with predictable cost ceilings. Agents wind down and summarize as they approach the limit.

Benchmark gains are real for software engineering. SWE-bench Verified climbed to 87.6% (from 80.8%), CursorBench hit 70% (from 58%), and Rakuten-SWE-Bench showed 3× more production tasks resolved than Opus 4.6. The 1M token context window and 128K max output tokens remain unchanged.

One cost caveat. Pricing holds at $15 / $75 per million input/output tokens on the API, but Opus 4.7 ships with a new tokenizer that can increase effective per-token consumption by up to 35% on some workloads (Simon Willison analysis). Third-party reviews also noted mild regressions on long-context tasks above ~100K tokens relative to Opus 4.6 (MindStudio). Factor both into budget and evaluation planning before migrating production workloads.

Opus 4.7 is available immediately via the Claude API, Claude Code, Amazon Bedrock, and the claude.ai web product.

Claude Design: Visual Work Enters the Conversation

Anthropic Labs released Claude Design on April 17 — a new product for creating polished visual work through conversational collaboration, powered by Opus 4.7. It handles prototypes, slides, one-pagers, brand assets, and motion graphics in a research preview available to Pro, Max, Team, and Enterprise subscribers.

The features that matter for enterprise teams: automatic application of team design systems (reads codebases and design files), organization-scoped sharing with view/edit permissions, and export to Canva, PDF, PPTX, or standalone HTML. The Claude Code handoff is notable — design sessions can package into a bundle that Claude Code builds with a single instruction, effectively bridging design and development workflows.

Anthropic explicitly positioned Claude Design as complementary to Canva, not a replacement. For consulting teams and marketing operations producing client deliverables, this lowers the bar for rapid visual prototyping without leaving the Claude ecosystem. Research-preview status still applies — pilot it internally before committing it to regulated or customer-facing work.

Claude Code Pricing: Pro Access Removed

The week’s most controversial move came April 21: Anthropic removed Claude Code from the $20/month Pro plan for new users. Access now starts at Max 5x ($100/month) or Max 20x ($200/month). Anthropic’s Head of Growth characterized this as a targeted test affecting ~2% of new prosumer signups, but the public pricing pages were updated globally before being partially reversed within hours.

Existing Pro and Max subscribers are not currently impacted. Team Standard ($25/seat) includes Sonnet 4.6 and Claude Code; Team Premium ($125/seat) includes Opus 4.6 with 5× limits.

What this means for teams. The effective minimum price for individual Claude Code access doubled. Organizations adopting Claude Code as a standard developer tool should evaluate Max or Team plans rather than relying on individual Pro subscriptions. This pairs with the broader enterprise pricing restructuring (The Register): bundled tokens were removed from Enterprise seats, and every token is now billed at standard API rates on top of the seat fee. Heavy users are unaffected; lighter users will see cost increases. Model the delta before your next renewal.

Claude Code Ships: v2.1.117 and v2.1.118

Two releases landed this week, and the features that matter most to enterprise operators are the WSL managed-settings inheritance, the plugin governance controls (blockedMarketplaces and strictKnownMarketplaces), and the stricter DISABLE_UPDATES environment variable. Together they give IT teams a cleaner path to deploy Claude Code into regulated Windows and WSL environments without developers circumventing policy.

v2.1.118 (April 23) adds vim visual mode (v/V) with selection operators, the merged /usage command (replacing /cost and /stats), custom themes under ~/.claude/themes/, hooks that invoke MCP tools directly via type: "mcp_tool", the stricter update-blocking envvar, and WSL-side inheritance of Windows managed settings via wslInheritsWindowsSettings. Auto-mode configs gain "$defaults" for layering custom rules over built-ins.

v2.1.117 (April 22) brings forked subagents on external builds, persisted model selections across restarts, concurrent MCP connections for faster startup, enforcement of plugin marketplace allow-lists in managed settings, and native-build swaps of Glob/Grep for embedded bfs and ugrep on macOS and Linux. Default effort for Pro/Max subscribers on Opus 4.6 and Sonnet 4.6 is now high.

The wider Claude Code Week 15 feature set continues rolling out: Ultraplan (cloud-based plan mode, drafted from CLI and reviewed in a web editor), the Monitor tool (background event streaming for tailing logs and auto-fixing CI failures), and /autofix-pr (watches CI and pushes fixes until green). The desktop app was rebuilt around parallel session management with SSH support, inline editing, integrated terminal, and custom layouts (MacRumors). Claude Code has now crossed 115K GitHub stars and 19.2K forks, with the claude-code-action CI integration at 6,300+ stars.

One April 2026 benchmark found Claude Code using 5.5× fewer tokens than competing CLIs for identical tasks (Fordel Studios) — a meaningful operating-cost differentiator as agentic workloads scale, though enterprise teams should run their own workload-representative evaluations before standardizing.

Agent SDK: Teams Go GA, Skills and Plugins Unify

Agent Teams graduated from preview to general availability. Unlike earlier subagent patterns where workers terminate after tasks, teammates persist across assignments and accumulate domain knowledge. Specialized agents (researcher, strategist, reviewer) run in parallel isolated contexts with peer-to-peer communication. Available on Pro and Max plans.

Anthropic also published guidance on five multi-agent architectures: generator-verifier, orchestrator-subagent, agent teams, message bus, and shared state — recommending orchestrator-subagent for most production deployments due to clear control boundaries and a manageable error surface.

The Skills and Plugins systems were unified. Skills now auto-generate slash commands, and plugins bundle skills, agents, hooks, and MCP servers into portable packages. Pre-built Agent Skills for PowerPoint, Excel, Word, and PDF shipped alongside. The Claude Agent SDK Python v0.1.0 is now on PyPI with two interaction modes: query() for stateless calls and ClaudeSDKClient for stateful multi-turn sessions. SessionStore.list_session_summaries() and import_session_to_store() provide the audit trail primitives that enterprise governance programs have been asking for.

This is the architectural stack we use to build governed, auditable agents at Big Hat Group — see our enterprise AI consulting practice for how these patterns translate into production deployments on Azure and Windows 365.

MCP: Record Growth Meets the First Major Security Test

The Model Context Protocol crossed 97 million monthly SDK downloads (up from 100K per month at its November 2024 launch), with adoption spanning Microsoft, Google, AWS, GitHub, VS Code, Cursor, Salesforce, Adobe, and Stripe.

Major server launches this week:

• Microsoft Power Platform MCP (public preview, April 22) — Dataverse query, create, view, and edit with custom-tool extensibility.
• Datadog MCP Server — Direct AI agent access to monitoring, observability, and incident data.
• Adobe Marketo MCP Server (Adobe Summit, April 19–22) — Marketing automation workflows via MCP.
• Klaviyo MCP Server — Customer data, segments, campaigns, and analytics.
• Stripe MCP Server — Official remote server at mcp.stripe.com.
• GitHub MCP servers as CLI commands (April 20) — MCP servers mountable as local CLI commands after gateway startup.
• Microsoft Fabric “Agentic Fabric” — Using MCP to turn Power BI and Fabric into AI-native data platforms.
• Azure Release Communications MCP — GA for AI-powered discovery of Azure updates.

And then the security disclosure. Researchers disclosed an MCP design vulnerability enabling remote code execution across 7,000+ public servers and 150M+ cumulative downloads — the STDIO transport accepts arbitrary OS commands without sanitization (The Hacker News). Anthropic declined to modify the protocol architecture, calling the behavior “expected.” Approximately 10+ high/critical CVEs were issued, including against LangFlow and multiple IDE integrations.

What enterprise teams should do now. Audit your MCP server supply chain and treat every MCP integration as a code-execution privilege grant. Prefer remote/managed MCP endpoints from vendors you already trust (Stripe, Datadog, Microsoft) over community packages. Deploy a gateway/proxy in front of local MCP servers and enforce allow-lists. Track the 2026 MCP Roadmap — Anthropic’s prioritized work on conformance test suites, SSO, audit trails into SIEM, and gateway patterns is the enterprise-readiness layer that was missing. At Big Hat Group we fold this work into our broader enterprise AI automation and governance practice.

Enterprise & Company: Revenue Doubling, AWS Direct, Windows Computer Use

Anthropic is growing at a pace that is hard to overstate. $30 billion-plus annualized run-rate revenue — up from ~$9B at end of 2025 — with Claude Code alone exceeding $2.5B in run rate. The company declined VC funding offers at valuations of $800B+ and sits at a $1T valuation on secondary markets. Enterprise customers spending $1M+ annually doubled to 1,000+ in two months, and the number of customers spending $100K+ grew 7× year-over-year.

Infrastructure. The Amazon compute partnership expanded (April 20) to up to 5 GW of Trainium capacity and a committed $100B+ in AWS technologies over 10 years, with potential for another $20B tied to commercial milestones. This complements the Google/Broadcom TPU deal announced April 6.

Claude Platform on AWS is the multi-cloud headline. Anthropic announced the full Claude Platform will run directly inside AWS with the same account structure, IAM controls, and billing — no separate credentials or contracts. Combined with existing availability on Google Cloud Vertex AI and Microsoft Azure AI Foundry, Claude becomes the only frontier model available natively across all three major hyperscalers. For enterprise procurement, compliance, and data-sovereignty planning, that is a materially different posture than any other frontier model vendor.

Computer Use on Windows. Claude’s Computer Use capability expanded to Windows for both Claude Cowork and Claude Code. Claude can now build apps, run tests, fix bugs, and interact with the Windows desktop directly — a substantial upgrade for teams standardizing on Microsoft endpoint environments. Combined with Windows 365 and Microsoft Intune, this opens a practical path to governed agentic automation inside managed Cloud PC estates.

Other enterprise signals.

• Claude Cowork in Amazon Bedrock — organizations can now run Cowork through existing AWS infrastructure.
• Enterprise admin features — SSO with JIT/SCIM provisioning, custom roles on Enterprise plans, Compliance API access to audit logs, SOC 2 Type II, HIPAA-readiness, private networking, and zero-day retention options.
• DoD supply chain risk dispute — Anthropic filed a 96-page appellate brief April 22; oral arguments May 19. White House Chief of Staff Susie Wiles is planning a meeting with Dario Amodei over Claude Mythos implications.
• Peak-hour rate limiting — users report more aggressive throttling weekday mornings (5–11 AM PT), undocumented.

Do not miss. Claude Sonnet 4 and Opus 4 retire June 15, 2026. Claude Haiku 3 was already retired April 20. Migrate to Sonnet 4.6 or Opus 4.7. Audit every production integration for hardcoded model IDs across direct API, Amazon Bedrock, Azure AI Foundry, and Google Vertex before the deadline.

Developer Sentiment: Adoption Up, Trust Under Pressure

The week’s technical achievements landed against a more complicated backdrop. The JetBrains Developer Survey (April 2026) reports 18% of developers worldwide actively using Claude Code — a 6× increase since mid-2025 and near-parity with Cursor. Awareness hit 57%. And yet a widely cited statistic from the same survey cycle: 84% of developers use AI coding tools, but only 29% trust what they ship.

The pricing confusion, silent effort-level reductions, and ongoing outage pattern through April have fed a narrative that Anthropic’s operational maturity is not yet keeping pace with its technical velocity. For enterprise IT leaders, the practical response is not to pull back but to insist on governance primitives that make AI outputs reviewable: audit trails through the Compliance API, effort-level telemetry via OpenTelemetry, and policy-enforced sandboxing through Managed Agents. The tools exist today. The work is wiring them into your enterprise controls plane.

What to Watch

• Claude Sonnet 4.8 expected May 2026 — Opus 4.7-class effort levels, task budgets, and vision coming to mid-tier pricing.
• Sonnet 4 / Opus 4 retirement, June 15, 2026 — the migration window is closing. Inventory model IDs now.
• Claude Platform on AWS launch — direct AWS account integration should meaningfully simplify enterprise procurement.
• MCP enterprise-readiness work — gateway/proxy patterns, conformance tests, SSO, and SIEM integration from the 2026 roadmap.
• Project Glasswing findings report — Anthropic committed to a public report within 90 days; first transparency benchmark for the Claude Mythos model.
• Claude Code pricing signal — watch whether the “limited test” expands or reverses. The Pro-plan removal may not be the last repricing this quarter.

Work With Big Hat Group

Opus 4.7 is the model to evaluate if you are building on Claude — the gains in vision, coding, and cost predictability through task budgets are meaningful enough to justify migration. But the week’s pricing, security, and deprecation signals also make clear that the hard part of enterprise AI adoption has moved from capability to governance: model migration discipline, MCP supply-chain audits, agent sandboxing, and integrated identity and audit trails.

Big Hat Group helps enterprise IT and security leaders translate these shifts into concrete rollout plans on the Microsoft stack. We deliver enterprise AI consulting for agentic workloads, Azure consulting for the underlying platform, Windows 365 consulting for governed endpoint access, and Microsoft Intune consulting for compliance and device hardening. If you need to stand up Opus 4.7 safely, migrate off Opus 4 before June, or build an MCP governance posture your CISO will sign off on, book a discovery call.

Check back next week for more from the Claude ecosystem.