Claude Security enterprise vulnerability scanner

Anthropic added continuous repository monitoring to Claude Security, its AI-powered vulnerability scanning tool, on October 21, 2026. The system watches connected repositories and rescans each code change as it lands, automatically marks a finding fixed when a patch ships, and reopens it if the vulnerability reappears. It incorporates notes from security staff and an editable threat model to assess whether vulnerabilities are reachable by attackers. Anthropic reports thousands of organizations have discovered over one million vulnerabilities using Claude Security since April. Claude Enterprise customers in the public beta receive $25,000 in monthly credits for two months through December 31, 2026.

The tool launched as a limited research preview on February 20, 2026, triggering sharp stock declines in cybersecurity companies: JFrog dropped nearly 25% on the day of release, and CrowdStrike, Datadog, and Zscaler fell on February 23, 2026. Anthropic opened Claude Security to public beta for Claude Enterprise customers on April 30, 2026, with Team and Max access described as coming soon. The tool requires no API integration, works with Claude Opus 4.7, and allows users to point it at a repository, directory, or branch; it identifies vulnerabilities, rates severity with confidence scores, explains how issues can be reproduced, and generates targeted patch instructions.

A separate Claude Code security plugin runs locally within a Claude Code session and counts toward the user's existing usage quota. A multi-agent pipeline handles scans: agents map architecture, build a threat model, find vulnerabilities, and independently review each finding before generating a report. Users can scope scans to an entire repository, a branch diff, a pull request diff, or a single commit. The plugin reaches code the managed Claude Security product cannot, including repositories on GitLab, Bitbucket, or networks that do not allow inbound connections. Anthropic also announced a broader Anthropic Cyber Mission that includes a Critical Infrastructure Defense Program, and a separate OSS Scanner offering free periodic security scans for open-source projects on an opt-in basis.