Anthropic's Claude Security Now Tracks and Fixes Over a Million Code Vulnerabilities

Anthropic has expanded Claude Security beyond one-time repository scans. The service now monitors code changes, updates findings when fixes land, reopens regressions, and exposes security data through an API and Model Context Protocol connector. The expanded version is available in public beta to Claude Enterprise customers.

Since the initial beta began in April, Anthropic says thousands of organizations have used the service to identify more than one million vulnerabilities. The latest release focuses on keeping those findings current as code changes and integrating remediation with existing developer workflows.

A baseline scan, then change-aware checks

Traditional static application security testing, or SAST, examines source code at a point in time, so findings can become stale before triage finishes. Teams connect repositories through the Claude GitHub app, which supports GitHub Enterprise Server, or use an access token for GitLab and other Git providers. After a team selects a branch and scan scope, Claude runs a deep baseline scan followed by targeted rescans. Their frequency depends on the risk and complexity of each change.

A project can group several repositories, giving Claude context across services. That broader view can expose issues such as a backend that trusts input a client was expected to validate. Repository-bound scans may miss such vulnerabilities because no single codebase contains the complete attack path.

Findings follow the code

Claude Security reevaluates open findings against changed code and marks a vulnerability fixed when the correction lands, whether the team made the change in Claude Code or through another development process. If a later change reintroduces the issue, the finding reopens automatically. This keeps ticket status aligned with the repository and prevents a regression from remaining hidden behind a closed finding.

Threat models drive the queue

Each project includes a knowledge base for deployment details, security policies, and undocumented operational context. Claude also generates an editable threat model from the code. Subsequent scans use that model to assess which findings apply to the project, reducing alerts for threats already mitigated by its architecture or policies.

The service combines the Common Vulnerability Scoring System with project-specific threat information when assigning severity. Findings may also include an attack-path diagram that shows how an attacker could reach the vulnerable code.

Nathan Hunstad, Vanta’s director of security, told Anthropic that findings better matched the company’s priorities after Vanta encoded its risk policy in the threat model, including which systems external users could reach.

API and MCP connect findings to code

Teams can use the new API to integrate Claude Security with ticketing systems, internal dashboards, and other security tooling. Supported operations include:

• Listing and reading projects and findings
• Creating projects and managing their repositories
• Resolving or reopening findings
• Sending webhook notifications when new findings appear
• Authenticating with personal access tokens limited to the user’s existing permissions

The Model Context Protocol, or MCP, connector gives Claude.ai and Claude Code access to project findings. An engineer can inspect a vulnerability, ask Claude for context, begin a fix, and update the finding during the same session. Role-based access controls let administrators assign separate permissions for viewing projects, triaging findings, and creating projects.

Enterprise beta includes two months of credits

The expanded release is available to Claude Enterprise customers through the admin console. Customers do not need separate access through Anthropic’s Cyber Verification Program.

Anthropic’s announcement does not list supported programming languages, API rate limits, automatic-resolution confidence thresholds, or standard pricing after the promotional credits expire. Setup instructions and full offer terms are available in the Help Center, while the setup guide covers initial project configuration.