Anthropic adds continuous code scanning and fix tracking to Claude Security

Anthropic updated Claude Security on October 21, 2026, to follow code changes and track whether vulnerabilities get fixed. Available in public beta for Claude Enterprise customers, the release adds ongoing repository scans, automatic finding-status updates, and ways to bring a team’s security policies into the scanner’s decisions about what deserves attention.

The update builds on a public beta that began in April. Anthropic says thousands of organizations have since used Claude Security to find more than one million vulnerabilities. That is a company-reported count of discoveries, not a tally of completed repairs.

A baseline scan, then checks as code changes

Teams connect their code repositories through the Claude GitHub app, including GitHub Enterprise Server, or through an access token for GitLab and other Git providers. They choose the branch and scope to examine. Claude Security first runs a deep baseline scan, then regularly scans changes according to their risk and complexity.

A project can contain several repositories, giving the scanner a view across services. Anthropic gives the example of a backend that trusts input because a client was supposed to validate it.

Open findings are checked against changed code. When a correction lands, Claude Security marks the finding fixed, whether the team made the repair in Claude Code or through another process. If the scanner detects the issue again later, it automatically reopens the finding.

Teams can tell the scanner what the code cannot

Each project now has a knowledge base for deployment details and security policies. Claude Security also generates a threat model—a description of relevant threats—from the code. Teams can review and edit that model, which informs subsequent scans and helps determine what gets flagged.

Anthropic says this context helps the scanner skip risks already handled by the environment. Each finding receives a severity rating judged against the project’s threat model, plus an explanation of how an attacker could reach the vulnerable code. Some findings also include an attack-path diagram.

In a testimonial published by Anthropic, Vanta security director Nathan Hunstad said findings better matched the company’s priorities after it added its own risk policy to the threat model. That policy focused on what external users could actually reach.

Findings move into developer workflows

• A new API, a software interface for connecting tools, lets teams manage projects, repositories, and findings. Webhooks notify other systems of new findings. Access tokens inherit the user’s permissions.
• A Model Context Protocol (MCP) connector brings Claude Security into Claude.ai and Claude Code. Engineers can retrieve findings, ask Claude about them, begin fixes, and mark them resolved within one session.

Administrators can separately control who views projects, triages findings, and creates projects. Enterprise admins enable Claude Security in the admin console; separate Cyber Verification Program access is not required.

Anthropic is offering organizations $25,000 in free usage credits per month for two months. The offer applies to usage through December 31, 2026, with full terms in its Help Center.