Claude Code Security Scans Codebases for Vulnerabilities and Suggests Patches

Claude

Feb 20, 2026 · Updated Jun 5, 2026

Claude Code Security launches as a new capability that scans codebases the way a human researcher would - reasoning about component interactions, not just matching known patterns. It finds vulnerabilities, suggests patches, and surfaces everything for human approval before applying.

Claude Code Security launches as a new capability built into Claude Code on the web. Rather than matching against known vulnerability patterns like static analysis tools, it reasons through how code components interact and traces data flows. Every finding goes through multi-stage verification, gets a severity rating and confidence score, and only reaches your dashboard after Claude has tried to disprove its own results.

Rule-based scanners catch predictable issues like exposed credentials but miss complex vulnerabilities - broken access control, business logic flaws - that attackers actually target. Anthropic's Frontier Red Team used Claude Opus 4.6 to find over 500 vulnerabilities in production open-source codebases that had survived years of expert review.

The research preview is open to Enterprise and Team customers. Open-source maintainers can apply for free expedited access, making this a practical option even for projects without a security budget.

View the full update on anthropic.com

Claude

@claudeaiFeb 20

Introducing Claude Code Security, now in limited research preview. It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss. Learn more: https://t.co/n4SZ9EIklG https://t.co/zw9NjpqFz9

5.4k

View on X

Every HeadsUpAI update is written based on its original source and reviewed before it's published. Read our editorial standards →

See all AI news & updates from Anthropic →

Keep reading

Anthropic Launches Claude Security Beta to Automatically Scan and Patch Codebases

Anthropic launched Claude Security in public beta for Enterprise customers to identify and remediate vulnerabilities across entire codebases. Unlike traditional scanners that rely on pattern matching, the tool uses reasoning to trace data flows and validate findings through an adversarial pass. This shift reduces false positive fatigue by ensuring every reported issue includes a verified, human-reviewable patch.

AnthropicMay 27

Anthropic Launches Security Guidance Plugin to Fix Vulnerabilities in Claude Code

Anthropic released an official security-guidance plugin for the Claude Code CLI that automatically detects and remediates vulnerabilities during active coding sessions. By shifting security reviews into the agent loop, the tool reduces downstream friction and has already cut security-related pull request comments by up to 40% in internal testing.

OpenAIMar 6

Codex Security Launches to Find, Validate, and Patch Code Vulnerabilities

OpenAI launched Codex Security, an AI agent that identifies complex code vulnerabilities, validates them automatically, and proposes targeted fixes. It cuts triage noise significantly, so security teams focus on real threats rather than false positives.

ReplitApr 21

Replit Launches Security Agent to Perform Deep Code Audits in Minutes

Replit launched the Security Agent, a specialized tool that performs full pre-launch audits by mapping application architecture and identifying exploitable vulnerabilities. It uses a hybrid approach to filter out 90% of false positives, securing AI-generated code without the weeks of manual review typically required by security engineers.