A security team can now run an analysis on their company's repository and obtain, in the same session, a list of vulnerabilities ordered by severity, with an associated confidence level and the necessary instructions to fix them. Anthropic has launched the public beta of Claude Security for all Claude Enterprise customers, without the need for API integrations or custom agent development.
The move comes at a time when the cybersecurity industry itself admits that artificial intelligence is narrowing the gap between the discovery of a software flaw and its actual exploitation. Anthropic presents Claude Security as a direct response to this problem, powered by Claude Opus 4.7, its most powerful general-purpose model, which it describes as one of the most capable for finding and fixing code vulnerabilities.
How Claude Security works: from repository to patch
Access is available from the Claude.ai sidebar or directly at claude.ai/security. The user selects a repository, or limits the analysis to a specific directory or branch, and starts the scan.
According to Anthropic, Claude does not just look for cataloged patterns, as a conventional security analyzer would. The model reasons about the code, trying to understand how different components interact across files and modules, follows data flow, and examines the source code directly.
Upon completing the analysis, the tool provides a detailed explanation of each finding: its confidence level, estimated severity, probable impact, and steps to reproduce the issue. Additionally, it generates instructions for a specific patch that the user can open in Claude Code on the Web and work on in context until the fix is applied.
Two months of preview with hundreds of organizations
The tool was previously called Claude Code Security. During a limited research preview, hundreds of organizations of varying sizes tested it, and that experience has shaped the design of the current version. Anthropic summarizes three lessons from that period.
The first is that the quality of detection is what determines whether a tool is adopted or not. Teams especially valued high-confidence findings, because they allow progress without wasting time on false positives. That is why Claude Security applies a multi-stage validation process that reviews each finding independently before displaying it, along with an assigned confidence level.
The second lesson is that the decisive factor is not just detection, but reducing the time between the scan and the applied fix. Several teams managed to go from analysis to patch in a single work session, compared to the usual days of back-and-forth between security and engineering.
The third is that organizations require continuous coverage, not one-off reviews that become outdated in weeks.
What the public beta adds: scheduled scans, export, and webhooks
The version available today incorporates features aimed at integrating into the daily work of security teams:
- Scheduled scans targeted at a specific directory within a repository.
- Dismissal of findings with documented reasons, so that future reviews can rely on previous triage decisions.
- Export of results in CSV or Markdown format, compatible with existing tracking and auditing systems.
- Sending results to Slack, Jira, or other tools via webhooks.
A practical case: from finding to pull request
Anthropic illustrates the workflow with a specific scenario: a team schedules a weekly scan on their application's payment directory. Claude Security detects a validation issue, explains how to reproduce it, and assigns a confidence level. The analyst dismisses two low-confidence findings while documenting the reason, exports the rest to Jira via webhook, and opens the suggested patch in Claude Code on the Web.
Matt Aromatorio, head of security at one of the organizations that tested the tool, summarizes his experience: the most valuable signal is the speed with which a finding becomes a pull request ready to merge, rather than remaining a simple pending ticket. According to his testimony, they have closed real vulnerabilities in minutes thanks to patches generated with the tool.
Suha Can, Vice President and Chief Security Officer (CSO) of DoorDash, maintains that the tool helps accelerate the generation and protection of new code at the scale the company requires, and that it allows findings to be channeled into engineering workflows so that action is taken in context. Greg Janowiak, Information Security Officer, adds that the tool captures the actual business logic of the code and allows moving from scan to fix in just a few clicks.
The partner ecosystem: CrowdStrike, Microsoft Security, Palo Alto Networks, and more
Anthropic does not reserve Claude Opus 4.7 exclusively for Claude Security. Among its technology partners, companies such as CrowdStrike, Microsoft Security, Palo Alto Networks, SentinelOne, TrendAI, and Wiz are incorporating the model into their own security products. On the services side, firms such as Accenture, BCG, Deloitte, Infosys, and PwC support organizations in the deployment of solutions integrated with Claude.
The company frames this strategy around the idea that defensive teams should access advanced capabilities in the way they find most comfortable: directly through Claude or through the security tools they already use in their day-to-day operations.
The context of Claude Mythos Preview and Project Glasswing
Anthropic places Claude Security alongside another recent initiative: Claude Mythos Preview, a model made available to a group of partners within Project Glasswing. According to the company, that model can match or exceed elite human experts in both finding and exploiting software vulnerabilities.
The company warns that future generations of models will be even more capable, especially at exploiting flaws autonomously. With that argument, it justifies the need to strengthen security now, in a scenario where locating functional exploits could become much easier. It is worth noting that this approach combines a warning about real risks with the commercial argument of a company that, precisely, sells the tool designed to address them.
What Claude Security implies for a security team
If an organization is already a Claude Enterprise customer, they can start scanning repositories without the need for additional development. The practical question is where the tool fits into the existing process. Claude Security does not replace human triage, but it transforms it: findings arrive accompanied by confidence, severity, and reproduction steps, and dismissals are recorded for future reviews.
Before adopting it, it is advisable to resolve four points: which repositories or directories to scan first and how often, whether results will be sent to Slack, Jira, or another tool via webhook, whether the CSV or Markdown export fits the internal audit system, and who will be responsible for validating patches before merging them into the main code.
For organizations that are not Claude Enterprise customers, access will likely arrive through the security tools of partners that integrate Claude Opus 4.7. Anthropic frames it in those terms, although it has not yet detailed specific schedules by product.
Frequently Asked Questions
What is Claude Security?
It is a tool from Anthropic that scans code repositories to detect vulnerabilities, explain their severity and confidence level, and generate patch instructions that can be worked on in Claude Code on the Web.
Who can use Claude Security right now?
It is available in public beta for all Claude Enterprise customers, accessible from the Claude.ai sidebar or from claude.ai/security, without additional API integrations.
What artificial intelligence model does it use?
It is powered by Claude Opus 4.7, Anthropic's most powerful general-purpose model, which the company describes as being especially capable of finding and fixing software vulnerabilities.
How does it differ from a traditional security scanner?
Instead of only looking for known patterns, Claude reasons about how code components interact between files and modules, follows data flow, and examines the source code directly.
What tools does the public beta integrate with?
It allows for scheduling periodic scans, exporting results in CSV or Markdown, and sending them via webhooks to platforms such as Slack or Jira, in addition to documenting the reasons for dismissed findings.
Which companies participated in the testing phase?
Anthropic notes that hundreds of organizations of various sizes tested an earlier version, then called Claude Code Security, during a limited research preview, including DoorDash.
Can I access Claude Security if I am not an Enterprise customer?
Anthropic indicates that access will likely arrive through technology partners such as CrowdStrike, Microsoft Security, Palo Alto Networks, SentinelOne, TrendAI, or Wiz, which are integrating Claude Opus 4.7 into their own products, although specific schedules have not yet been detailed.
