Anthropic launches Claude Security: an AI service that finds code vulnerabilities and proposes patches

On April 30, 2026, Anthropic opened a public beta of Claude Security, a tool for finding vulnerabilities directly in a company's codebase. The service runs on Claude Opus 4.7, analyzes the repository on its own, verifies its findings and suggests what is worth fixing first.

Who can use it, and why

Claude Security, previously called Claude Code Security, is now available to Claude Enterprise customers. In essence, it is an attempt to turn a strong model into a practical working tool for security teams: no separate API integration, no custom agent builds and no manual stitching together of a pipeline from several services. A company that already uses Claude can enable the new mode through the admin console and start scanning repositories almost immediately. Access for Team and Max is promised later.

For Anthropic, this is not just another AI feature in the IDE. The company explicitly ties the launch to the acceleration of cyber threats: models are finding weaknesses in software faster and faster, so defenders need a new tempo too. That is why the product is pitched not as a replacement for the AppSec team, but as a way to shorten the path from detecting a problem to having a ready patch. In an enterprise setting, that time saving is usually what decides whether a bug makes it into a release.

How the analysis works

Claude Security can be opened from the Claude sidebar or through a dedicated security interface. The user selects a repository, a branch or a specific directory, and the model starts scanning. Unlike classic rule-based scanners, Anthropic is betting on contextual analysis: the system tracks connections between modules, looks at how data flows through the code and tries to understand the application's actual logic rather than just matching signatures. This approach matters especially for logic errors and access-control problems.

The output is not just a list of suspicious spots but a more practical package. Claude shows how confident it is in a finding, how critical it is, what damage it could cause and how to reproduce the problem. It then generates instructions for a targeted fix and, if needed, opens a task in Claude Code on the Web, where the patch can be refined in the context of the specific file and related code.

"AI compresses the time between discovering a vulnerability and exploiting it," is how

Anthropic explains its bet on such tools.

What was added after the preview

Anthropic says hundreds of organizations tested Claude Security during the two-month preview. Based on that period, the company polished not showcase features but the things security teams need in daily work. The developers' main conclusion is simple: the value lies not in scanning itself, but in the speed at which a finding becomes a confirmed ticket and then a real fix. So the release focuses on operational details.

• Scheduled scans instead of one-off checks
• Targeted scans of a directory inside a repository
• Fewer false positives through multi-stage validation of findings
• Export of results to CSV and Markdown for audit and tracking
• Sending results to Slack, Jira and other systems via webhooks

Anthropic separately stresses that the tool can store the reasons findings were dismissed, so the next scan does not resurface already-reviewed cases without context. This matters for large companies, where triage is often spread across security staff, developers and platform teams.

In parallel, the company is expanding its deployment network: Opus 4.7 capabilities are already being built into products from CrowdStrike, Microsoft Security, Palo Alto Networks, SentinelOne, TrendAI and Wiz, while Accenture, BCG, Deloitte, Infosys and PwC help roll out such scenarios in corporate processes.

What this means

Anthropic is pushing the market toward a model in which AI in security handles not only bug discovery but also prioritization, risk explanation and fix preparation. If detection quality really turns out to be high, large teams could close complex logic vulnerabilities faster, ones that ordinary static scanners miss for years, and the window between detecting a problem and fixing it would become noticeably shorter. For large product teams, this is no longer an experiment but a potential part of the standard secure development process.