Anthropic puts Claude Security on autopilot

Most security scanners are the ultimate chore. You run a scan once, get buried under hundreds of false alarms, and the second a teammate merges a new pull request, your report is already outdated.

Anthropic just rolled out a major overhaul to Claude Security, turning its enterprise vulnerability scanner into a continuous, context-aware engine that watches your repos around the clock.

Continuous scans that clean up after themselves

Since entering public beta in April, thousands of organizations have used Claude Security to uncover more than one million vulnerabilities. But until now, scans were mostly point-in-time snapshots.

The new version hooks directly into GitHub, GitHub Enterprise Server, or GitLab. After an initial baseline scan, Claude automatically tracks your branches and rescans changes based on risk and complexity, meaning you no longer have to schedule manual audits.

It also supports multi-repo projects. This lets the model spot complex cross-service logic flaws, such as a backend API blindly trusting input that the frontend was supposed to validate.

Even better, it tracks resolutions. Whether your engineers patch a flaw using Claude Code or push a fix through their standard workflow, Claude Security automatically marks the finding resolved once the code ships. If someone accidentally reintroduces the bug later, the issue reopens itself.

Bringing architecture context into the loop

Standard static analysis tools often cry wolf because they do not understand what is actually exposed. To fix this, Anthropic is letting teams build a project knowledge base describing deployment setups, firewall controls, and internal policies.

Claude also generates an editable threat model directly from your codebase. Findings now include severity ratings tied to that threat model, along with exploit path diagrams so developers know how an attacker could actually reach the flaw.

On the integration side, Anthropic introduced a full API, webhooks, role-based access controls, and an MCP connector. An engineer inside Claude.ai or the Claude Code CLI can pull up a vulnerability, ask Claude for the best fix, implement it, and mark it resolved in a single session.

The system runs on Anthropic's full model lineup, including Claude Mythos, without requiring special safety program approvals. To get teams hooked, Anthropic is handing Claude Enterprise customers $25,000 per month in free credits for two months through December 31, 2026.

Why it matters

Anthropic is systematically eliminating the friction between finding a bug and fixing it. Traditional AppSec tools hand developers a giant spreadsheet of alerts and walk away. By pairing continuous repo scanning with the Claude Code ecosystem and MCP, Anthropic is positioning itself not just as a scanner, but as an automated remediation pipeline.

For engineering leaders, the ability to catch multi-repo logic errors is the real selling point. Customers like IonQ note that Claude caught critical architectural issues that standard penetration tests completely missed. With $50,000 in promotional compute credits on the table, it is a no-brainer for enterprise customers to test immediately.

The clever play here is ecosystem lock-in. Once your team configures its deployment context, threat models, and MCP workflows inside Claude, switching away becomes painful. The only lingering question is cost: deep semantic analysis across large codebases is computationally heavy, and teams will have to evaluate whether the continuous scanning bills remain sustainable once the promotional credits run out.