Anthropic Launches Claude Security: AI Vulnerability Scanning Built Into Claude Code

Anthropic has released Claude Security, a public beta plugin for Claude Code that scans your recent changes — or an entire codebase — for high-severity vulnerabilities right in the terminal. It's aimed squarely at the gap between "code review caught it" and "code review didn't," and it's live now for all Claude Code users.

What It Actually Does

Instead of the pattern-matching that traditional static analysis tools rely on, Claude Security reasons through the code the way a security researcher would: tracing data flows, understanding context across multiple files, and following how a value moves from an untrusted input to a dangerous sink. That cross-file reasoning is the headline feature — the class of bug that traditional SAST tools miss most often is exactly the kind that only makes sense once you've read three files, not one.

The pipeline runs in three stages:

1. Scan — a coordinated set of agents maps the codebase and analyzes it in parallel, looking specifically for injection flaws, authentication bypasses, memory corruption, and complex multi-file logic errors.
2. Validate — before anything surfaces to you, Claude runs "adversarial verification": a second pass explicitly trying to refute its own findings. This is the step aimed directly at false-positive fatigue, the single biggest reason security tooling gets ignored by engineering teams.
3. Patch — for confirmed findings, Claude proposes a targeted fix that preserves the surrounding code's structure and style, for a human to review and apply.

How Teams Turn It On

It's a beta feature for Claude Enterprise and Claude Code users, enabled by an org admin through the admin console. Once on, it can run against a diff before a commit or as a deeper scheduled sweep across an entire repo, and findings can push out via webhook to Slack or Jira, or export as CSV/Markdown for whatever tracker you already use.

Why This Matters — and What It Doesn't Change

The pitch is real: an AI reviewer that understands intent and data flow catches a different, often more dangerous, class of bug than a regex-based scanner — the auth-bypass-three-functions-deep kind, not the "you used eval()" kind. And putting it directly in the terminal, in the same tool developers are already using to write the code, removes the friction that kills adoption of most AppSec tooling: nobody has to open a second dashboard.

What it doesn't change: Anthropic is explicit that every suggested patch needs human review before it ships, especially anywhere near critical systems, and that effectiveness still varies with code type and complexity. This is a very good second pair of eyes, reasoning at a level static analysis tools can't reach — not a replacement for a security review process, and not a substitute for understanding why a class of vulnerability exists in the first place.

That last part is the piece that doesn't automate: knowing why an auth-bypass pattern is dangerous, how an attacker would actually chain it, and what the incident looks like when someone finds it before your tooling does. That's the muscle PlayCISO's SOC and War Room scenarios are built to train — the judgment layer that sits above whatever scanner you're running.

Full story: cybersecuritynews.com — Anthropic Launches Claude Security Plugin

---

Want to test how well your team reasons about a vulnerability once a scanner finds it? Work a live SOC case →