Alberta Government Uses Claude Code to Scan and Fix 466M Lines of Code in Hours

TL;DR

The Government of Alberta used Anthropic’s Claude Code (Opus and Sonnet) to scan 466 million lines of code in 20 hours, automatically generate and test patches, and set up continuous AI‑driven security agents—compressing a multi‑year effort into days.

Overview of the Initiative

Alberta’s Ministry of Technology and Innovation manages the software stack for all 27 provincial ministries, encompassing roughly 1,280 applications and 3,400 code repositories. Much of this code had never undergone systematic security review, leading to billions of dollars in technical debt and exposure of highly sensitive data such as tax records and social‑services case files. In 2025 the Ministry created an internal team to partner with Anthropic’s Claude Code to address these risks at scale.

Massive Code‑Base Assessment

Scope: 466 million lines of code across every repository owned by the province.
Resources: Approximately 50 autonomous Claude agents running in parallel.
Process: A two‑stage routine—first a rules‑engine scan to flag known vulnerability patterns, then a Claude‑driven review that cites the exact file and line for each finding.
Outcome: The scan completed in 20 hours, a task the team estimates would have required about 6.5 years with traditional methods. The AI identified issues missed by conventional static analysis tools.

Automated Vulnerability Remediation

Patch Generation: Claude Code generated fixes for most flagged vulnerabilities, wrote missing tests when needed, and rebuilt legacy components in modern languages.
Speed: Some systems, such as a 25‑year‑old Java subsidy portal, were rebuilt in 4–5 days versus the original five‑month development cycle.
Human Oversight: All patches were reviewed and approved by Ministry engineers before deployment, ensuring safety and compliance.

Continuous AI‑Driven Security Review

Specialized Agents: Built on the Claude Agent SDK, the Ministry deployed:
- A red‑team agent that simulates external attacks to map exploitation paths.
- A blue‑team agent that evaluates defenses against an international security standard and produces remediation plans with precise file references.
- Additional agents that enforce code‑quality and public‑facing documentation standards.
Coverage: Each application is checked against roughly 95 security controls on every pass, providing ongoing assurance throughout the development lifecycle.

Capacity‑Building Through the Alberta AI Academy

Training Reach: Thousands of government employees and over 10,000 members of the public have completed AI‑use courses covering prompting, enterprise application delivery, and responsible AI practices.
Goal: Extend the Claude‑based security workflow from a single team to every provincial ministry.

Future Plans and Scaling

New Software Generation: The Ministry intends to develop AI agents capable of building entirely new tools alongside engineers.
Legacy Consolidation: One ministry’s 185 legacy applications will be analyzed, documented, and consolidated into 16 reusable, modern applications, reducing maintenance costs and modernization timelines.
Provincial Rollout: A fall program will scale the Claude‑based approach across all provincial departments.

Blueprint for Other Governments

Alberta’s experience is documented in a series of technical white papers (available at the Velocity Whitepapers site) and will be shared at an industry day in Edmonton in July. These resources provide a reproducible framework for other jurisdictions facing similar technical debt and security challenges.

Related Anthropic Announcements

Improving Fable 5’s biology safeguards – see the Anthropic blog for details.
Mariano‑Florentino (Tino) Cuéllar joins Anthropic as Chief Global Affairs Officer – read the announcement for context.