Claude Security adds continuous scanning
Confirmed
The takeaway
On Oct 21, 2026 Anthropic made Claude Security, its code-vulnerability scanner, continuous: after a baseline scan it re-scans repositories as code changes, tracks findings until a fix ships and reopens them if they return.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 22 October 2026
Your AI and this story
- GPT-6 Astra174 days after its cutoff
- Claude Opus 5.5113 days after its cutoff
- Gemini 4 Argon204 days after its cutoff
- Grok 4.7143 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 113 days before it.
Key facts
- Announced Oct 21, 2026 (claude.com article and @claudeai post, ~680k views on Oct 22); Claude Security itself entered public beta in April 2026
- Models: ‘Anthropic’s full model family, including Claude Mythos’, with no Cyber Verification Program access required
- Continuous scanning: connect repositories via the Claude GitHub app (incl. GitHub Enterprise Server) or a GitLab/Git token; a baseline scan, then re-scans of changes chosen by risk and complexity; one project can span several repositories
- Fix tracking: open findings are re-checked against changed code and marked fixed when a fix ships (from Claude Code or elsewhere); they reopen automatically if detected again
- Triage: per-project knowledge base and editable threat model; each finding gets a severity judged against the threat model, an exploit-path explanation and optionally an attack-path diagram
- Integrations: API to list, read, resolve and reopen findings and manage projects; personal access tokens and webhooks; MCP connector for Claude.ai and Claude Code; role-based access controls
- Scale claim (Anthropic): thousands of organisations since April; ‘over one million vulnerabilities’ found
- Offer: $25,000 in free usage credits per month for two months, covering usage through Dec 31, 2026; public beta for Claude Enterprise customers, enabled by admins
Show 2 more
- Customer quote (IonQ’s Jon Donovan): ‘Claude Security found many material issues that a traditional pen test conducted at the same time missed’
- Context: launched the same day OpenAI and Wiz disclosed PHP2Shell, found with GPT-5.6 Sol and Gemini 4 Argon
What happened
Anthropic turned Claude Security from a one-off scanner into a continuous one. Once a repository is connected, Claude keeps its findings in step with the code: it rescans what changes, closes findings when they are fixed, and reopens them if they come back. The product runs on Claude Mythos among other models; access to Mythos-level vulnerability finding normally requires Anthropic’s Cyber Verification Program, which this product does not.
The April 2026 beta launch is not yet an entry of its own; this entry rests on the Oct 21 article, which gives the April date.
Why it matters
Frontier labs are now selling automated vulnerability discovery to defenders at scale while the same capability finds internet-wide bugs such as PHP2Shell. The “one million vulnerabilities” figure (Anthropic’s own, unaudited) is a measure of how much latent risk these tools surface, and of the patching load they create.
Sources
3 sources from 2 sites. Numbers match the chips in the text.
3 sources: 3 primary
Primary
- Claude: Claude Security now scans continuously and tracks fixes (Oct 21, 2026)claude.com, official
- Claude Security product pageclaude.com, official
- @claudeai on X: Claude Security now keeps up with your code as it changesx.com, official
Changes
- Filed (the product had no entry)