Anthropic Debuts Claude Code Security for AI-Driven Vulnerability Scanning
Anthropic has begun rolling out a new security capability for its Claude Code product that inspects software repositories for security flaws and proposes corrective patches. The feature-called Claude Code Security-is being released as a limited research preview and is currently available to Enterprise and Team tiers.
According to the company’s recent announcement, the tool automatically combs through codebases to surface security issues and produces focused remediation suggestions that require a human reviewer’s approval. The aim is to help engineering teams discover and remediate vulnerabilities that conventional methods can overlook.
Anthropic framed the capability as a defensive response to the same machine-learning advances that attackers are leveraging to accelerate vulnerability discovery. As automated agents become more proficient at finding weaknesses that escaped human inspection, Claude Code Security is intended to give defenders similar automation to narrow the advantage adversaries might gain.
Anthropic says the system is designed to move beyond simple pattern matching or static analyzers. Rather than just searching for known signatures, Claude Code Security attempts to reason about the code as a security researcher would: mapping component interactions, tracing the flow of data across the application, and identifying risky behaviors that rule-based scanners may miss.
Findings reported by the system undergo a staged verification pipeline intended to reduce false positives. Each flagged issue receives a severity score so teams can prioritize the most critical weaknesses first. The consolidated findings and proposed fixes are presented in a Claude Code Security dashboard where security analysts and developers can inspect the source, review suggested patches, and approve any changes.
Anthropic also stressed a human-in-the-loop model: the product supplies confidence metrics for each reported issue and does not automatically apply fixes. Developers retain final authority over whether to accept or deploy the recommended patches.