Anthropic Ships Claude Security to Catch Vulnerabilities Before You Commit

Anthropic has shipped the Claude Security plugin for Claude Code in public beta. It brings vulnerability scanning directly into your terminal workflow: scan staged changes before a commit, or sweep your entire codebase, without leaving Claude Code. The plugin runs on the same Claude inference you're already using, so there's no separate tool to authenticate or manage.

Why rule-based scanners fall short

Traditional security scanners rely on pattern matching against known vulnerability signatures. They're fast, but they miss anything that doesn't fit a recognized pattern and generate substantial noise in the process. Claude Security reasons through code the way a security researcher would, following logic across files and understanding context rather than hunting for string matches.

Anthropic's stated motivation is timing. AI models are already effective at finding software flaws, and the next generation will be capable of autonomously exploiting them at scale. The plugin puts those same capabilities on the defender's side, inside the editor, before a line of vulnerable code reaches a pull request.

Three layers of review

The plugin doesn't ask the model that wrote the code to grade itself. Reviews run as separate Claude calls with fresh context and a security-focused prompt, so the reviewer has no stake in the original approach. That separation happens across three distinct layers:

• Per-edit pattern check: A fast, deterministic string match that fires every time Claude writes to a file. No model call, no added cost. Catches things like eval(, pickle, innerHTML =, and edits to .github/workflows/.
• End-of-turn diff review: After each turn, the plugin diffs everything that changed in the working tree and sends it to a separate Claude model focused on security. It runs in the background so your session isn't blocked. If it finds something, Claude is re-prompted and addresses it as a follow-up.
• Commit/push review: When Claude runs git commit or git push, a deeper agentic review starts. This one reads surrounding code, callers, and related files to decide whether a finding is real before surfacing it, keeping false positives low.

Every finding also goes through an adversarial verification pass where Claude challenges its own results before reporting them. The goal is fewer false positives without burying real issues.

What it catches, and what it doesn't

Claude Security targets high-severity vulnerabilities: memory corruption, injection flaws, authentication bypasses, and complex logic errors that pattern-matching tools typically miss. The end-of-turn model review extends that to authorization bypasses, insecure direct object references, server-side request forgery, and weak cryptography.

The plugin does not block writes or commits. Findings surface as instructions to Claude, which addresses them in the same conversation. A few operational limits are worth knowing:

• Claude can make mistakes. Review proposed patches before applying them, especially on critical systems.
• Commit and push reviews only fire on commits Claude makes through its Bash tool. Commits you run from your own shell are not reviewed.
• The end-of-turn review covers up to 30 changed files per turn and runs at most three consecutive times before yielding back to you.
• Commit reviews are capped at 20 per rolling hour.

Installation and configuration

Installation is a single command inside a Claude Code session (version 2.1.144 or later required, along with Python 3.8+ on your PATH):

/plugin install security-guidance@claude-plugins-official
/reload-plugins

On first run, the plugin creates a virtual environment under ~/.claude/security/ and installs the Claude Agent SDK. To enable it for everyone on a project, add this to your repo's settings file:

// .claude/settings.json
{
  "enabledPlugins": {
    "security-guidance@claude-plugins-official": true
  }
}

You can extend the plugin's behavior without touching its built-in checks. Drop a .claude/claude-security-guidance.md in your project to give the model-backed reviewer your threat model in plain language, or add a .claude/security-patterns.yaml to inject custom regex or substring rules into the per-edit pattern check:

# .claude/security-patterns.yaml
patterns:
  - rule_name: internal_api_key
    substrings: ["sk_live_", "AKIA"]
    reminder: "Hardcoded API key prefix. Load credentials from the secret manager."
  - rule_name: tenant_unfiltered_query
    regex: "\\.objects\\.all\\(\\)"
    paths: ["**/src/tenants/**"]
    reminder: "Multi-tenant code must filter by org_id."

Where it fits in the stack

The plugin is the in-session layer of a larger Claude security toolchain. It reduces what reaches a pull request; Code Review catches what does. The full picture:

Stage	Tool	What it covers
In session	Security guidance plugin	Vulnerabilities in code Claude writes, fixed immediately
On demand	/security-review command	One-time security pass on the current branch
On pull request	Code Review (Team/Enterprise)	Multi-agent review with full codebase context
In CI	Existing static analysis tools	Language-specific rules, supply-chain checks

The plugin sits alongside the broader Claude Security product, available in public beta for Enterprise customers, which handles full codebase scans with scheduled runs, webhook integrations to Slack and Jira, and findings exported as CSV or Markdown. Separately, Anthropic has made Claude Mythos Preview, a model capable of matching or surpassing elite human experts at finding and exploiting software vulnerabilities, available to select partners through Project Glasswing. The terminal plugin puts the most powerful generally available model, Claude Opus 4.7, to work for a much wider set of organizations.

Cost and availability

The per-edit pattern check is free because it makes no model calls. End-of-turn and commit reviews consume model usage like any other Claude request, defaulting to Opus 4.7. You can override the model with the SECURITY_REVIEW_MODEL environment variable for end-of-turn reviews and SG_AGENTIC_MODEL for commit reviews. The plugin is available on all Claude Code plans. The broader Claude Security product for full codebase scanning remains Enterprise-only for now, with Team and Max plan access coming soon.

Enterprise beta users reported going from scan to applied patch in a single sitting rather than days of back-and-forth between security and engineering teams. Catching a bug at the moment of writing is cheaper than catching it anywhere else in the pipeline.