Introduction

Anthropic has begun rolling out a new security capability for Claude Code that scans software codebases for vulnerabilities and suggests targeted patches. The feature, named Claude Code Security, is currently available in a limited research preview for Enterprise and Team customers. This article explains what Claude Code Security does, how it works in practice, benefits and limitations, and best practices for using AI-assisted vulnerability scanning in production software development workflows.

What is Claude Code Security?

Claude Code Security is an AI-powered code scanning feature integrated with Anthropic’s Claude Code product family. Its main purpose is to analyze a user codebase, identify potential security vulnerabilities, and provide suggested fixes or targeted patches. The initial release is a research preview limited to Enterprise and Team customers, allowing Anthropic to gather feedback and refine the tool before broader availability.

How Claude Code Security Works

Static analysis with AI assistance – The feature uses AI models to parse code, detect risky patterns, insecure configurations, and common vulnerability types across languages and frameworks.
Context-aware patch suggestions – Instead of generic guidance, Claude Code Security aims to provide targeted suggestions and example patches tailored to the codebase context.
Research preview feedback loop – Early access customers can validate findings, report false positives, and help improve detection accuracy and patch recommendations over time.

Key Benefits

Faster vulnerability discovery – AI-assisted scanning can accelerate the initial discovery of security issues compared to manual review alone.
Actionable remediation – Suggested patches help development teams move quickly from detection to remediation with concrete code-level guidance.
Scalability – Automated scanning can be applied across large repositories and multiple projects, improving coverage and consistency.
Developer productivity – Integration within developer workflows can reduce context switching and lower time to fix security findings.

Limitations and Security Considerations

False positives and negatives – As with any automated scanner, the output can include incorrect findings or miss subtle issues. Human verification remains essential.
Preview access – The feature is currently in a limited research preview. Availability and capabilities may change as Anthropic iterates on the product.
Data handling and privacy – Organizations should review Anthropic service terms, data retention policies, and security controls before scanning sensitive or proprietary code. Ensure compliance with internal governance and regulatory requirements.

How to Access Claude Code Security

At present, Claude Code Security is being rolled out to Enterprise and Team customers in a research preview. Teams interested in early access should contact Anthropic sales or account representatives to inquire about participation. Organizations that participate in previews typically provide feedback on accuracy, usability, and integration needs.

Best Practices for Using AI-Powered Code Scanners

Combine AI with human review – Use AI findings as a prioritized input, then validate and triage issues with security engineers or experienced developers.
Integrate into CI/CD – Automate scans in continuous integration pipelines to catch regressions early and enforce quality gates.
Use staged environments – Run initial scans on copies or sanitized versions of repositories to reduce exposure of secrets or sensitive data.
Track remediation metrics – Monitor time to fix, recurrence of issue types, and false positive rates to measure tool effectiveness over time.

How Claude Code Security Compares to Traditional Tools

Traditional static application security testing tools rely on rule-based engines and signatures. AI-powered tools like Claude Code Security augment those approaches by offering context-driven analysis and suggested fixes that are more tailored to the codebase. However, mature SAST and dynamic analysis tools remain important parts of a comprehensive security program. Organizations should view AI scanners as complementary rather than replacement technologies.

Common Use Cases

Pre-commit and pre-merge scanning to prevent vulnerable code from entering main branches
Periodic repository audits to discover legacy vulnerabilities
Developer education by surfacing typical security mistakes and recommended patterns
Rapid remediation during incident response or code reviews

Conclusion

Claude Code Security represents Anthropic’s step into AI-driven developer security tooling, combining vulnerability detection with targeted patch suggestions. While currently available only in a limited research preview for Enterprise and Team customers, it highlights the growing role of large language model technology in software security. Teams evaluating the feature should weigh the benefits of faster, context-aware findings against the need for human validation and careful handling of code and data during scans.

Frequently Asked Questions

Who can access the preview – Access is limited to Enterprise and Team customers participating in the research preview.
Does it produce ready-to-apply patches – The tool provides suggested fixes, but organizations should review and test any changes before applying them to production.
Is it a replacement for SAST – No. It should be used alongside existing security tools and practices for a layered approach to application security.

Anthropic Unveils Claude Code Security: AI-Powered Vulnerability Scanning for Codebases