Anthropic Claude now scans repositories for security flaws

Key Takeaways

• Anthropic has upgraded Claude Security with continuous scanning capabilities for code repositories.
• The AI-powered service now automatically monitors code changes, tracks vulnerability fixes, and reopens issues if they reappear.
• Currently in public beta for Claude Enterprise customers, it aims to provide real-time security insights closer to the development lifecycle.
• Anthropic claims over a million vulnerabilities have been identified since the beta launch in April, though this figure is unconfirmed.

Anthropic Enhances Claude Security with Continuous Repository Scans

Anthropic has significantly updated its Claude Security offering, introducing continuous scanning of connected code repositories. This enhancement moves the service beyond on-demand scans, enabling it to automatically monitor changes in real time rather than requiring manual initiation.

The upgraded platform also features robust vulnerability tracking. It now identifies and marks reported vulnerabilities as fixed when corrections are implemented by developers, and critically, reopens them if the issues resurface in later code iterations. This advanced version is currently available in public beta for Claude Enterprise clients.

Since its public beta debut in April, Anthropic states that thousands of organizations have leveraged Claude Security, leading to the discovery of over one million vulnerabilities. It is important to note that this figure originates from the company and has not been independently verified.

This strategic update is designed to empower security and development teams with more immediate insights into their software’s security posture. The goal is to detect new risks introduced by fresh code and to ensure that previously implemented fixes remain effective, addressing potential regressions.

Continuous Scanning and Comprehensive Analysis

Teams initiate the process by establishing a project, integrating their code repositories, and specifying the branches and code segments for analysis. Claude Security supports integration via the Claude GitHub app, including GitHub Enterprise Server, and also accommodates access tokens for GitLab and other Git providers.

The service commences with an exhaustive deep scan to establish an initial security baseline. Following this, it intelligently monitors subsequent code modifications, with scanning intervals dynamically adjusted based on the perceived risk and complexity of the changes. Anthropic emphasizes that there is no rigid scanning schedule.

A single project within Claude Security can encompass multiple repositories, a crucial feature for identifying complex security issues that span across interlinked services. For instance, if a backend service implicitly trusts client-side input validation, a flaw might not reside in a single file but in the interaction between components. By analyzing connected codebases, Claude Security can evaluate such relationships and trace data flow paths throughout an application.

As Anthropic describes the tool, it leverages its sophisticated Claude models, including Claude Mythos, for its security analysis capabilities. The company clarifies that customers do not need access to the Cyber Verification Program to utilize this product. Scan results typically include a severity rating, contextualized by the project’s specific threat model, a detailed explanation of how vulnerable code paths can be exploited, and in some instances, a visual diagram illustrating the attack flow within the application.

This updated service builds upon Anthropic’s earlier security scanning endeavors. Previous iterations, such as Claude Code Security, focused primarily on identifying and reviewing code defects. The evolution highlights the growing need for continuous monitoring, especially as AI tools become more integrated with development workflows and project configurations.

Intelligent Vulnerability Management and Contextualization

Identifying a security flaw is merely the initial step in effective vulnerability management. Teams must then assess the relevance of the finding to their specific environment, assign it for remediation, implement the necessary changes, and verify its resolution. Claude Security addresses this by automatically comparing open findings against modified code, marking issues as fixed even if the remediation occurs outside the Claude Code environment. Should a subsequent scan detect the same issue, the finding is automatically reopened.

The service also allows teams to incorporate external knowledge that code alone cannot convey. Projects can be enriched with details regarding software deployment methodologies, applicable security policies, and existing protective controls within a system.

Claude Security automatically generates a threat model from the codebase, which teams can review and refine. Subsequent scans then utilize this contextualized model to prioritize issues and accurately assess their severity. This contextual awareness helps reduce noise by de-emphasizing risks that the organization has already mitigated, though teams are still responsible for validating the accuracy of this information.

Integration and Access Control

To facilitate seamless integration into existing security workflows, Anthropic has introduced an API, webhooks, and an MCP connector for Claude.ai and Claude Code. The API provides capabilities for reading findings, managing projects, and programmatically resolving or reopening issues.

Webhooks can be configured to deliver real-time alerts when new security findings emerge. The MCP connector enables engineers to collaborate on findings and coordinate fixes directly within a Claude session. Furthermore, role-based access controls (RBAC) empower administrators to define granular permissions for viewing projects, reviewing findings, or creating new projects.

As the service remains in beta, organizations are advised to consider its findings and fix statuses as valuable indicators rather than a complete substitute for human expert review. Anthropic’s help documentation explicitly states that scan results can vary between runs and that all proposed fixes should undergo thorough review before implementation.

What You Should Do

• For Claude Enterprise customers, explore the public beta of the updated Claude Security to leverage its continuous scanning and tracking features.
• Integrate Claude Security with your GitHub, GitLab, or other Git providers to establish a baseline scan and begin continuous monitoring.
• Review and customize the automatically generated threat models to align with your organization’s specific security posture and existing controls.
• Utilize the API, webhooks, and MCP connector to integrate Claude Security findings into your existing vulnerability management and development workflows.
• Always treat AI-generated findings and proposed fixes as valuable signals, but ensure they undergo human review and verification before deployment, especially for critical issues.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.