Claude Code can now audit and fix security flaws

AI coding assistants are great at shipping code at lightning speed, but that speed often comes with a messy side effect: new security vulnerabilities slipping right into production.

Anthropic just rolled out automated security reviews in Claude Code. The update brings security checks straight into your everyday workflow through both a local terminal command and an automated GitHub Action.

Catching bugs in the terminal and on PRs

Developers can now run a new /security-review command directly inside Claude Code before ever pushing their code.

Claude scans the local codebase using a security-focused prompt to flag common threats, including SQL injection, cross-site scripting (XSS), auth flaws, insecure data handling, and sketchy dependencies. If it spots a problem, Claude explains the issue and can write the patch for you on the spot.

For team workflows, Anthropic also launched a GitHub Action that triggers automatically whenever a new pull request is opened.

It analyzes code changes, applies custom rules to filter out known issues or false positives, and leaves inline comments on the PR with actionable remediation suggestions.

Eating their own dog food

Anthropic says its own engineering team has already been testing these tools on internal projects and on Claude Code itself.

Last week, engineers built an internal tool that spun up a local HTTP server. The GitHub Action caught a remote code execution vulnerability exploitable through DNS rebinding before the PR was merged.

In another instance, an engineer built a proxy system for managing internal credentials, and the tool flagged an SSRF risk, allowing the team to patch it immediately.

Both the terminal command and the GitHub Action are available now for all Claude Code users.

Why it matters

We think Anthropic is hitting the right pain point by bringing security scans directly into the inner development loop.

Most security scanning tools act as friction, flagging giant reports long after code has been committed. Letting developers spot flaws in the terminal and asking the AI to immediately patch them makes security feel like auto-complete rather than a chore.

It also shifts the AI coding race from pure speed to code reliability. Competitors will likely feel the pressure to bake similar guardrails into their own CLI and IDE extensions.

Still, relying on LLMs to grade their own homework has risks. Automated prompts can miss complex zero-days or hallucinate false positives, so teams shouldn't treat this as an excuse to skip human security audits entirely.