Anthropic has rebuilt Claude Security around continuous monitoring. In a post on claude.com on October 21, the company said the product no longer waits for someone to start a scan: it keeps up with connected repositories as code changes, tracks each vulnerability finding until the fix ships, and uses context supplied by the security team itself to decide what deserves attention.
The updated version is available now in public beta for Claude Enterprise customers. Anthropic says it is powered by its full family of models, including Claude Mythos, and that no Cyber Verification Program access is required. Eligible organisations receive $25,000 in free usage credits each month for two months, under an offer that applies to usage through December 31, 2026.
Claude Security: Continuous Monitoring Replaces One-Off Scans
Setup starts with a project. Teams connect repositories through the Claude GitHub app, including GitHub Enterprise Server, or with an access token from GitLab and other Git providers, then choose the branch and scope for each repository. According to the Claude Help Center documentation, a project can hold up to eight repositories, and each one can be in scope, meaning Claude scans it and reports findings in it, or used for context only, meaning Claude reads it during scans but reports nothing in it. Both count toward the limit.
Claude then runs a deep baseline scan, which can take minutes or hours depending on repository size. After that, there is no fixed schedule: the Help Center says post-baseline scans are stochastic by design, triggered regularly based on the risk and complexity of the changes, because Claude Security uses an agent that adapts its analysis to each run rather than applying fixed pattern matches. Multi-repository projects let the scanner catch issues that live between services, such as a backend that trusts input a client was supposed to validate.
Claude Security: Fix Tracking, Threat Models And Severity Paths
Each vulnerability is now tracked as its own item until it is resolved. When Claude Security detects the code change that fixes a flaw, it marks the finding as fixed automatically, whether the team fixed it in Claude Code or in a separate process, and if the same issue resurfaces later the finding reopens on its own. Every finding also carries a severity rating judged against the project’s own threat model, plus an explanation of the exploit path, how an attacker could reach the vulnerable code.
That threat model is partly written by the customer. Each project has a knowledge base where teams describe how their code is deployed, which security policies apply, and anything a new security engineer would need to know. Claude Security also generates a threat model from the code that the team can review and edit, and later scans use those models to decide what is worth flagging and to skip risks the environment already handles.
Claude Security: API, MCP Connector And A Claude Code Plugin
Findings can leave the product through a new API and through webhooks, and Claude Security is also available as an MCP connector in Claude.ai and Claude Code, so an engineer can pull up a finding, ask Claude about it, start the fix and mark it resolved in the same session. The API lets customers list and read projects and findings, resolve or reopen findings, and create and manage projects and their repositories, using a personal access token that can only see and change what its user can.
Alongside the main product, Anthropic is running a parallel beta plugin for Claude Code that runs local, session-specific scans on particular repositories or individual changes. The defensive push sits next to Anthropic’s research work, including Claude cutting OpenSSH’s reachable code by a fifth, and it lands in a market where offensive use is accelerating too, as the OpenCode console breach that exposed provider API keys showed earlier this month. New role-based access controls round out the release, letting admins decide who can view projects, triage findings and create projects.
Why It Matters
Claude Security matters most as a change in timing. A point-in-time scan goes stale the moment the next commit lands, and enterprise code changes every day, so a scanner that follows the code, and then verifies the fix instead of trusting a ticket status, closes the two gaps where vulnerabilities usually linger. Anthropic’s claim that thousands of organisations have used the product to find over a million vulnerabilities since the April beta is a company-reported discovery count, not a count of completed repairs, and the automatic fix tracking is clearly aimed at exactly that credibility gap. For security teams the practical test is whether the findings survive contact with their own threat models, which is why the editable per-project threat model and the $25,000 monthly credit offer are doing as much work as the scanning itself. Readers new to the product line can start with what Claude is and what it can do.
Background
Claude Security entered public beta in April 2026 as Claude Enterprise’s code-scanning product, built on the same model family Anthropic sells for general reasoning and coding work. Since then Anthropic has steadily widened its security line, from the free OSS Scanner for open-source projects to red-team research on widely used infrastructure code. This release is the product’s second major step: from a scanner customers run, to a monitor that runs itself.
Source: Claude (Anthropic), Unite.AI
0 Comments