Anthropic's new security tool treats your code like a researcher would, then suggests fixes

Anthropic is making a bet that the best way to sell AI to enterprise security teams is to have it do the one thing those teams hate most: dig through thousands of lines of code to find something wrong, then offer a fix before anyone has to open a ticket.

Claude Security, now in public beta for Claude Enterprise customers, scans a codebase, validates its own findings through an adversarial pass, and produces suggested patches. The company says it targets the kind of vulnerabilities that traditional scanners miss, context-dependent flaws that span multiple files.

The feature is available as a plugin inside Claude Code, Anthropic's terminal-based coding agent. Admins enable it via the admin console, and scans can be scoped to a specific directory or run on a schedule.

How it works

Anthropic describes the pipeline in three steps. First, Claude reads the codebase and traces data flows across files, trying to identify multi-component vulnerability patterns. Then a validation step runs what the company calls an 'adversarial verification pass', essentially, Claude challenges its own preliminary findings before showing them to the team. Finally, it surfaces the confirmed vulnerabilities alongside a proposed patch.

The adversarial pass is the key differentiator here. Traditional SAST tools and pattern-based scanners produce high false-positive rates, which is the main reason security teams stop trusting them. Anthropic is betting that a model that can reason about its own conclusions will flag less noise.

Whether that holds at scale is the open question. The post does not disclose an internal false-positive rate or benchmark comparisons against existing tools like Semgrep, Snyk, or GitHub's own CodeQL. A similar approach from Sakana AI's Fugu-Cyber suggests raw models alone aren't enough, as the company warned against trusting a single model's output.

What it finds

According to the documentation, Claude Security focuses on memory corruption, injection flaws, authentication bypasses, and complex logic errors. Those are the same categories every serious scanner targets, but Anthropic argues that the model's ability to read Git history and understand business logic lets it catch issues that depend on cross-file context, a vulnerability whose trigger is in a config file and whose payload lands in an API handler, for example. This cross-file reasoning matches the kind of automated pipeline seen in VulnClaw's pentesting agents, which use natural language to chain exploits across components.

The feature ships with webhook integration to push findings into Slack, Jira, or any ticketing system. Results can also be exported as CSV or Markdown. Scans can be scoped to a specific directory and scheduled for recurring runs.

The plugin model

Claude Security also exists as a plugin for Claude Code, currently in beta. Running inside the terminal, it keeps all code inside the user's environment. That design matters for regulated teams: Anthropic leans on it as a reassurance that intellectual property never leaves the local machine during scans.

In a companion blog post, Anthropic published research on LLM-discovered zero-days, framing security scanning as a natural, and growing, use case for frontier models. The company also ran an experiment using Claude to defend critical infrastructure, suggesting it sees this as more than a developer tool, part of a broader shift where AI agents are rewriting the rules of cybersecurity.

What it means

Anthropic is entering a crowded market. Every cloud provider and security vendor now offers AI-assisted code scanning, and the enterprise space is already fought over by GitHub Copilot Autofix, Snyk Code, and dozens of startups. What sets Claude Security apart is the adversarial validation step and Anthropic's own security reputation, the same models that secure Anthropic's production code are running these scans. But that pitch only works as long as the false-positive rate stays low and the patches don't break production. As a recent AgentScope study highlighted, often the harness, not the model, is what trips up AI agents in real workflows. Anthropic is clear that every patch requires human approval, which is the only sensible position for a product that carries the liability of suggesting code changes to critical systems.