Anthropic tests Claude Code Security to protect code

Anthropic has launched Claude Code Security, a tool that analyzes codebases, detects complex vulnerabilities, and proposes patches for a human team to review before applying them.

The feature has been available since February 20, 2026, in a limited research preview for Enterprise and Team customers. Open-source project maintainers can request free, expedited access.

Beyond searching for known bugs

Traditional security analysis tools usually rely on rules: they look for exposed passwords, outdated encryption, and other patterns that have already been identified. They are useful, but they can miss flaws that depend on how several parts of an application interact.

Claude Code Security tries to analyze code the way a security researcher would. It follows the flow of data, understands the relationship between components, and looks for business logic issues or poorly implemented access controls.

That makes it possible to find vulnerabilities that do not appear when reviewing each file separately. For example, it might detect that an apparently protected function allows access to sensitive information when combined with another part of the system.

AI proposes, people decide

Each finding goes through several checks before reaching the security team. Claude examines it again to try to confirm or dismiss the issue and reduce false positives, meaning alerts that appear to be vulnerabilities but are not.

The results appear in a dashboard with several details:

• The detected vulnerability.
• Its severity level.
• A confidence level for the finding.
• A suggested patch to fix it.

Nothing is applied automatically. Developers review the issue, inspect the proposed change, and decide whether to approve it. The tool speeds up the investigation, but it does not replace the team's responsibility.

What Anthropic has found

The feature is based on more than a year of work on Claude's cybersecurity capabilities. Anthropic says its team, using Claude Opus 4.6, found more than 500 vulnerabilities in production codebases from open-source projects.

According to the company, some of these flaws had gone unnoticed for decades despite years of review by experts. Anthropic is still working with maintainers to classify the issues and disclose them responsibly, so the figure does not mean they have all been fixed already.

The company also uses Claude to review its own code and presents this tool as a way to make those defensive capabilities available to more teams.

What changes for you

If you manage a digital product, the tool could help you review more code with the same team and prioritize the highest-risk flaws first. For open-source projects, where security often competes with limited resources, free access could be especially relevant.

But the launch also makes the new cybersecurity balance clear: the same AI that helps find flaws can help an attacker locate them. The difference will be who discovers them first and who manages to fix them.

Anthropic expects a significant share of the world's code to be analyzed by AI in the coming years. What you will need to watch now is whether these tools find real problems with few false positives and whether teams can review and apply the fixes quickly enough.