Anthropic's Claude Security now checks company code nonstop for flaws

Anthropic has updated Claude Security so it keeps watching a company's code as it changes, instead of waiting for a person to start each scan. It also follows each security flaw it finds, marks it fixed when a correction shows up, and reopens it if the problem comes back. The update is in public beta for Claude Enterprise customers.

What changed

Before, a scan was something a team ran by hand. Now teams create a project, connect their code repositories (the places where code is stored), and choose which branches and code areas to check. The tool first does a deep scan to set a baseline. After that, it checks new changes at intervals based on how risky and complex they are. Anthropic says there is no fixed schedule.

Anthropic says thousands of organizations have used Claude Security since its public beta began in April, and that they found more than one million vulnerabilities. That figure comes from the company and has not been independently confirmed.

How it works

A project can include several repositories. That matters because some security problems sit between two services, not inside one file. For example, a backend service may assume a client already checked what a user typed. Looking across connected code can help spot that kind of gap.

Each finding comes with a severity rating, an explanation of how the flawed code could be reached, and in some cases a diagram of the path through the application. The tool builds a threat model from the code, which is a summary of what needs protecting and from what. Teams can edit it and add details about deployment, security rules and existing protections.

• Works with the Claude GitHub app, including GitHub Enterprise Server
• Supports access tokens for GitLab and other Git providers
• Offers an API, webhooks and a connector for Claude.ai and Claude Code
• Includes role-based access controls for who can view or create projects

Fixes are tracked too

Finding a flaw is only the start. Someone must decide if it applies, assign it, change the code and confirm it is gone. Claude Security checks open findings against new code and can mark them fixed, even if the work happened outside Claude Code. If a later scan sees the same issue, the finding reopens.

What to keep in mind

This is still a beta. Anthropic's help documentation says scan results can vary between runs and that proposed fixes should be reviewed before use. The threat model also depends on the information a team gives it, so that information needs to be correct.

For a business that builds software, the appeal is catching problems sooner and seeing which ones are truly closed. The safest approach is to treat the results as useful signals and keep a person checking them.