Claude Security Now Scans Repositories Continuously to Find Vulnerabilities and Track Fixes

Anthropic has updated Claude Security so it can keep checking connected code repositories as they change, rather than waiting for a person to start each scan.

The service also tracks reported vulnerabilities after developers make changes, marks them fixed when a correction is detected, and reopens them if they return. The updated product is in public beta for Claude Enterprise customers.

Anthropic says thousands of organizations have used Claude Security since its public beta began in April, finding more than one million vulnerabilities. That figure comes from the company and has not been independently confirmed.

The update aims to help security and development teams keep findings closer to the current state of their software, where new code can introduce risks and older fixes can stop working.

Claude Security Continuous Scans

Teams start by creating a project, connecting repositories, and choosing the branches and code areas to scan. The service supports the Claude GitHub app, including GitHub Enterprise Server, and access tokens for GitLab and other Git providers.

It first performs a deep scan to set a baseline. After that, it checks code changes at intervals based on their risk and complexity. Anthropic says there is no fixed scan schedule.

A project can include multiple repositories. This matters because a security problem may involve how two services work together, rather than a flaw in one file. For example, a backend service may trust that a client has already checked user input. Looking across connected code can help Claude Security assess such relationships and trace how data moves through an application.

Anthropic describes the tool as using its Claude models, including Claude Mythos, for security analysis. It says customers do not need access to the Cyber Verification Program to use the product. Findings include a severity rating based on the project’s threat model, an explanation of how the vulnerable code may be reached, and, in some cases, a diagram showing the path through the application.

The company says its updated service builds on an earlier security-scanning effort. Cyber Security News previously reported on Anthropic’s launch of Claude Code Security, which focused on finding and reviewing code flaws. Its coverage of Claude Code vulnerabilities also highlights why teams need to consider security boundaries when AI tools work with project files and development settings.

Finding a problem is only one part of vulnerability management. Teams still need to decide whether a finding applies to their environment, assign it, make a change, and confirm the issue is gone. Claude Security checks open findings against changed code and can mark them fixed when a correction lands, even if the work happened outside Claude Code. If a later scan detects the same issue again, the finding reopens.

The service also lets teams add knowledge that code alone cannot show. A project can include details about how software is deployed, which security rules apply, and what controls already protect a system.

Claude Security generates a threat model from the code, which the team can review and edit. Later scans use that model to help judge which issues matter and how severe they are. This context can reduce attention on risks that the organization has already addressed, though teams still need to check that the information is correct.

To fit existing security work, Anthropic has added an API, webhooks, and an MCP connector for Claude.ai and Claude Code. Teams can use the API to read findings, manage projects, and resolve or reopen issues.

Webhooks can send alerts when new findings appear. The MCP connector lets engineers discuss a finding and work on a fix from a Claude session. Role-based access controls let administrators set who can view projects, review findings, or create projects.

The service remains in beta, so organizations should treat its findings and fix status as useful signals, not a replacement for human review. Anthropic’s help documentation says scan results can vary between runs and that proposed fixes should be reviewed before use.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Claude Security Now Scans Repositories Continuously to Find Vulnerabilities and Track Fixes appeared first on Cyber Security News.