Summary: Anthropic's Claude Code Security

Overview

Anthropic has launched Claude Code Security, a new capability integrated into Claude Code on the web, now available in a limited research preview. It is designed to help security teams find and fix complex, context-dependent software vulnerabilities that traditional tools often miss.

• Target Users: Enterprise and Team customers, with expedited access for open-source repository maintainers.
• Core Function: Scans codebases for security vulnerabilities and suggests targeted software patches for human review.
• Key Problem Addressed: The overwhelming volume of software vulnerabilities versus the limited number of skilled human researchers to address them.

How It Works

Claude Code Security moves beyond traditional rule-based static analysis by reasoning about code like a human security researcher.

• Methodology: Understands component interactions, traces data flow, and catches complex vulnerabilities (e.g., business logic flaws, broken access control).
• Verification Process: Every finding undergoes a multi-stage verification where Claude re-examines and attempts to prove/disprove its own results to filter false positives.
• Output & Action:
  • Findings are assigned severity ratings and a confidence rating.
  • Validated findings appear in a dashboard for team review.
  • Human approval is required for all suggested patches; the tool identifies problems and suggests solutions, but developers make the final call.

Research Background & Capabilities

The tool builds on over a year of dedicated cybersecurity research.

• Proven Efficacy: Using Claude Opus 4.6, Anthropic's team found over 500 vulnerabilities in production open-source codebases—bugs that had gone undetected for decades despite expert review.
• Research Activities: Includes stress-testing in competitive Capture-the-Flag events and a partnership with Pacific Northwest National Laboratory to defend critical infrastructure.
• Internal Use: Anthropic uses Claude to review its own code, finding it "extremely effective at securing Anthropic's systems."

Strategic Outlook & Getting Started

Anthropic positions this as a critical step in an AI-driven cybersecurity arms race.

• Industry Trend: Expects a significant share of the world's code to be scanned by AI soon due to its effectiveness.
• Defender's Advantage: Aims to empower defenders to find and patch weaknesses faster than attackers can exploit them.
• Access: The limited research preview is open now. Participants will collaborate directly with Anthropic's team.
  • Apply for access: [Link provided in original article]
  • Learn more: claude.com/solutions/claude-code-security

Key Quote: "Claude Code Security is intended to put this power squarely in the hands of defenders and protect code against this new category of AI-enabled attack."