Anthropic Announces Claude Code Security Research Preview

TL;DR

Claude Code Security, an AI‑powered vulnerability scanner built into Claude Code, is now offered as a limited research preview, enabling defenders to automatically detect and patch complex security issues that traditional rule‑based tools miss.

What Claude Code Security Is

Claude Code Security is a new capability integrated into the Claude Code web interface. It performs static analysis of codebases, identifies security flaws, and generates targeted patch suggestions for human review. The service is currently available to Enterprise and Team customers, with expedited free access for open‑source maintainers.

How It Differs From Traditional Static Analysis

Traditional static analysis tools rely on rule‑based pattern matching, catching obvious problems such as exposed credentials or outdated cryptography. Claude Code Security instead reads and reasons about code like a human security researcher:

  • Understands component interactions and data flow.
  • Detects complex issues such as business‑logic errors and broken access controls that rule‑based scanners typically miss.
  • Performs a multi‑stage verification where Claude re‑examines each finding to prove or disprove it, reducing false positives.
  • Assigns severity and confidence ratings to prioritize remediation.

All findings are presented in a dedicated dashboard where analysts can review the suggested patches and approve fixes. No code is changed automatically; developers retain final authority.

Technical Foundations and Recent Results

Claude Code Security builds on more than a year of research into Claude’s cybersecurity abilities, including:

  • Participation in competitive Capture‑the‑Flag events.
  • Collaboration with Pacific Northwest National Laboratory on AI‑assisted critical‑infrastructure defense.
  • Use of Claude Opus 4.6 (released early 2026) to discover over 500 previously unknown vulnerabilities in production open‑source projects, many of which had persisted for years despite expert review.

Anthropic is coordinating responsible disclosure with affected maintainers and plans to expand community involvement.

Deployment Workflow

  1. Code Ingestion – Claude scans the repository via the Claude Code interface.
  2. Automated Reasoning – The model analyses code semantics, data flow, and component interactions.
  3. Verification Loop – Claude attempts to validate each finding, filtering out likely false positives.
  4. Severity & Confidence Scoring – Findings receive quantitative ratings to guide triage.
  5. Dashboard Review – Security teams inspect findings, view suggested patches, and approve or reject fixes.

Implications for the Security Landscape

Anthropic emphasizes that AI is a double‑edged sword: the same capabilities that empower defenders can be weaponized by attackers. By releasing Claude Code Security to defenders first, Anthropic aims to raise the baseline security of software ecosystems and mitigate the risk of AI‑enabled exploits.

The announcement signals a shift toward AI‑driven code security at scale, suggesting that a substantial portion of global codebases may soon be continuously scanned by models like Claude.

Getting Started

Interested organizations can apply for early access through the research preview program. Open‑source maintainers are encouraged to request expedited, free access.

Related Anthropic Announcements

Sources

Related