Anthropic Opens Claude Security Beta: Codebase Scanner That Drafts Patches, Not Just Flags Findings
Anthropic has opened Claude Security in public beta for Claude Enterprise customers, adding a codebase vulnerability scanner directly into Claude.ai. The product is distinct from Project Glasswing, the multi-lab security coalition Anthropic co-announced with Amazon, Apple, Google, and Microsoft earlier this year. Claude Security is an Anthropic-only product aimed at enterprise engineering teams.
The Problem It’s Targeting
Traditional static analysis tools find issues by pattern-matching against known vulnerability signatures. Many serious bugs — authentication bypasses, insecure data flows, permission escalation paths — only manifest through the interaction of multiple files across a codebase. Pattern matchers generate both false positives and blind spots at scale.
Claude Security runs full-context analysis: it traces how data, permissions, and control flow move across files before concluding a vulnerability exists. Each finding returns severity, affected file and line number, an explanation of why the issue holds up in context, and a suggested fix.
How It’s Packaged
The product sits inside Claude Code on the Web, within Claude Enterprise. Teams do not need a separate API integration or custom agent scaffold — if they’re already running Claude Enterprise, the scanner is available as a built-in workflow.
Setup requires the Anthropic GitHub App and GitHub.com repositories. Access is tied to premium user seats with consumption billing and configurable spend limits. Anthropic recommends narrower scan scope for large repos and monorepos to improve reliability.
Feature Set
- Scope control: Scan by branch or directory
- Parallel projects: Multiple concurrent scan sessions
- Effort modes: Regular and Extended — extended runs deeper analysis at higher cost
- Recurring scans: Schedulable for continuous monitoring
- Output options: CSV or Markdown export, webhook or email delivery
- Remediation workflow: Each finding can open directly into a Claude Code session that generates a candidate patch
- Dismissals: Findings can be dismissed with a reason that carries forward across future scans, preventing noise recurrence
Positioning
The launch comes directly alongside the AISI evaluations showing frontier models can autonomously execute multi-step corporate cyberattacks. Anthropic’s framing — scanner that finds bugs before attackers do, runs under enterprise controls, outputs patches not just alerts — positions it as a defensive counterpart to the capability the labs themselves are demonstrating on the offensive side.
The product is restricted to Claude Enterprise customers on GitHub.com (not GitHub Enterprise Server). No public API access and no self-hosted option are mentioned in the current beta.