Claude Security can now spot vulnerabilities that reappear in code

Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes.

The service scans codebases for vulnerabilities and suggests patches for review. It is powered by the company’s full family of models, including Claude Mythos, without requiring Cyber Verification Program access.

Scanning code and tracking fixes

Teams create a project, connect repositories through the Claude GitHub app or an access token from GitLab or another Git provider, and select the branch and scope for each repository. Claude then runs a baseline scan, followed by recurring scans of changes based on their risk and complexity. This keeps findings aligned with the code’s current state. Projects can contain multiple repositories, allowing Claude to detect issues that span services.

“Teams told us they wanted coverage that stays current without anyone having to schedule it,” Anthropic explained.

Watching for changes (Source: Anthropic)

Claude Security checks open findings against code changes and marks them as fixed when a patch lands, whether it was developed in Claude Code or through another process. If the service detects the issue again, it reopens the finding.

Each project has a knowledge base where teams can document how the code is deployed, which security policies apply, and what a security engineer joining the team should know.

Claude Security also generates a threat model from the code for teams to review and edit. Subsequent scans use this context to assess which issues to flag and account for risks addressed by existing controls.

“Claude Security found a number of logic flaws that none of our other tools had caught. Once we wrote our own risk policy into the threat model, focusing on what external users can actually reach, the findings matched how we prioritize instead of only a severity score,” Nathan Hunstad, Director of Security at Vanta, said.

Prioritizing findings and connecting workflows

Each finding includes a severity rating assessed against the project’s threat model and an explanation of how an attacker could reach the vulnerable code. These details help teams prioritize fixes. Findings can also include a diagram of the attack path.

A new API connects Claude Security to existing workflows, allowing teams to manage projects and repositories, view findings, and resolve or reopen issues. Access tokens inherit the user’s permissions, while webhooks notify connected systems of new findings.

An MCP connector lets engineers access findings in Claude.ai and Claude Code, discuss issues with Claude, start fixes, and mark findings as resolved within the same session.

New role-based access controls let administrators assign permissions to view projects, triage findings, and create projects. Teams can receive access to the service without project creation privileges.

The update is available in public beta for Claude Enterprise customers. Administrators can enable it in the admin console and choose who has access.