Claude Security continuously monitors code and flags fixed bugs

Anthropic's Claude Security service is designed to help companies find security holes in their own code. The service is in public beta for Claude Enterprise customers, and according to Anthropic's product page, it first runs a deep baseline scan, a thorough initial review. After that, it scans continuously each time the code changes, so users don't have to start every scan themselves.

According to the outlet TestingCatalog, Claude assesses new changes by risk and complexity.

Fixes are tracked automatically

Claude Security compares open findings against the changed code and marks a finding as fixed when the fix reaches the code. According to TestingCatalog, this also applies to fixes made outside Claude Code. If the vulnerability reappears, the finding is reopened automatically.

Each finding gets a severity rating and an explanation of how an attacker could reach the vulnerable code. Some findings also include a diagram of the attack path.

Context and setup

An organization creates a project and connects its code repositories through the Claude GitHub app, including GitHub Enterprise Server. GitLab and other Git providers are connected with access tokens. A project can contain several repositories, so the system can find weaknesses across services, for example a backend that trusts input a client was supposed to have validated.

In a knowledge base, the team can describe operational practices, security policies and controls that the code alone doesn't reveal. The service also builds an editable threat model from the code and uses it, along with the extra context, in later scans.

API and integration with Claude Code

According to TestingCatalog, the new API can list and read projects and findings, resolve or reopen findings, and manage projects and repositories. Webhooks can notify connected systems of new findings. An MCP connector makes it possible to pull up a finding, discuss it, start a fix and mark it resolved in the same session in Claude or Claude Code. Role-based controls govern who can view projects, assess findings and create projects.

Numbers and offer

TestingCatalog reports that thousands of organizations have used the service since the beta began in April, and that they have found more than one million vulnerabilities. The figure comes from the article and has not been confirmed in a primary source.

According to TestingCatalog, the service runs on the entire Claude model family, including Claude Mythos. Enterprise administrators can enable it in the admin console. According to the same source, $25,000 in free monthly usage credit is planned for two months, for usage through December 31, 2026.