Claude Security Now Scans Repositories Continuously to Find Vulnerabilities and Track Fixes

Anthropic has updated Claude Security so it can keep checking connected code repositories as the code changes. Teams no longer have to ask it to start every scan themselves.

The service also keeps track of reported security problems after developers change the code. It marks a problem as fixed when it detects a correction and opens the finding again if the problem returns. The updated product is available in public beta for Claude Enterprise customers.

Anthropic says thousands of organizations have used Claude Security since its public beta started in April, finding more than one million security problems. This number comes from the company and has not been independently verified.

The update is designed to help security and development teams keep track of problems as their software changes. New code can create security risks, and changes can also cause old fixes to stop working.

Claude Security Continuous Scans

Teams begin by creating a project, connecting code repositories, and choosing which branches and parts of the code to scan. The service works with the Claude GitHub app, including GitHub Enterprise Server, as well as access tokens for GitLab and other Git providers.

First, it performs a detailed scan to create a starting point for comparison. After that, it checks code changes at intervals based on how risky and complex they are. Anthropic says scans do not follow a fixed schedule.

A project can include several repositories. This is useful because a security problem may come from the way two services work together, rather than from a flaw in a single file. For example, a backend service might assume that a client has already checked the user's input. By examining connected code, Claude Security can look at these relationships and follow how data moves through an application.

Anthropic describes the tool as using its Claude models, including Claude Mythos, to analyze security. The company says customers do not need access to the Cyber Verification Program to use the product. Each finding includes a severity rating based on the project's threat model, an explanation of how the vulnerable code might be reached, and, in some cases, a diagram showing the route through the application.

The company says the updated service builds on its earlier work on security scanning. Cyber Security News previously reported on the launch of Claude Code Security, which focused on finding code flaws and reviewing them. Its report on Claude Code vulnerabilities also explains why teams need to think about security boundaries when AI tools can access project files and development settings.

Finding a security problem is only one part of managing vulnerabilities. Teams must still decide whether the problem affects their own systems, assign someone to handle it, change the code, and check that the problem is gone. Claude Security checks open findings against updated code and can mark them as fixed when a correction is added, even if the change was made outside Claude Code. If a later scan finds the same problem again, the finding is reopened.

The service also lets teams add information that cannot be learned from the code alone. A project can include details about how the software is deployed, which security rules apply, and which protections are already in place.

Claude Security creates a threat model from the code, which the team can review and change. Later scans use this model to help decide which problems matter and how serious they are. This extra information may help teams spend less time on risks their organization has already dealt with, but they still need to check that the information is correct.

To work with the security tools teams already use, Anthropic has added an API, webhooks, and an MCP connector for Claude.ai and Claude Code. Teams can use the API to view findings, manage projects, and mark problems as fixed or reopen them.

Webhooks can send alerts when new security problems are found. The MCP connector lets engineers discuss a finding and work on a fix during a Claude session. Role-based access controls allow administrators to decide who can view projects, review findings, or create projects.

The service is still in beta, so organizations should treat its findings and fix status as helpful information, not as a replacement for human review. Anthropic's help documentation says scan results may differ between runs and that suggested fixes should be reviewed before they are used.