Claude Security Enhances Continuous Vulnerability Scanning

Anthropic has introduced significant updates to Claude Security, enhancing its capability to continuously monitor connected code repositories for vulnerabilities. This advancement allows the system to autonomously initiate scans as repository changes occur, eliminating the need for manual prompts.

Continuous Monitoring and Vulnerability Tracking

The enhanced service now diligently tracks vulnerabilities reported post-code alterations, identifying when corrections are made. It is designed to reopen issues if vulnerabilities reappear. Currently, this updated version is accessible in public beta, exclusively for Claude Enterprise users.

Since its public beta inception in April, Anthropic reports that Claude Security has been employed by thousands of organizations, uncovering over a million vulnerabilities. However, this statistic has yet to be independently verified.

Improved Integration and Scanning Capabilities

Claude Security now supports a variety of repository connections, including the Claude GitHub app and GitLab access tokens, among others. Users can initiate a comprehensive initial scan to establish a baseline, followed by periodic checks that factor in risk and complexity levels.

This approach allows for the incorporation of multiple repositories into a single project. Such integration is crucial, as security issues often arise from interactions between different services, not merely from isolated file defects. For instance, backend services might rely on client-side checks without additional validation, a risk that can be mitigated by comprehensive scanning.

Enhanced Security Analysis with AI Models

Utilizing Claude models like Claude Mythos, the tool provides a detailed security analysis, including severity ratings and diagrams illustrating vulnerable code pathways. This analysis is independent of the Cyber Verification Program, making it widely accessible.

Anthropic highlights the new service’s roots in their prior security scanning initiatives, emphasizing the importance of considering security boundaries when AI tools interact with project files.

The updated service also incorporates APIs, webhooks, and an MCP connector, facilitating seamless integration into existing security workflows. Teams can leverage these tools to manage findings, projects, and communication efficiently.

While still in beta, Claude Security’s findings and proposed fixes are intended to serve as helpful guides rather than substitutes for thorough human review. Anthropic advises that scan results may vary, underscoring the necessity of reviewing suggested fixes before implementation.