Skip to content

Back to the catalog

Claude Security
claude.comtool

Claude Security

Claude Security is Anthropic's AI-powered code scanning product (currently in beta for Claude Enterprise and as a Claude Code plugin) that uses the Claude Mythos 5 model to trace data flows across files, find high-severity vulnerabilities (memory corruption, injection, auth bypass, complex logic errors), and validate findings via an adversarial self-check before proposing human-reviewable patches. It integrates with GitHub, Slack, Jira, and webhooks for triage/audit workflows and supports scheduled or directory-scoped scans.

TL;DR Anthropic's AI code-scanning tool that finds and patches vulnerabilities using Claude Mythos 5 with adversarial validation.
Open original ↗
Document

What it is

Claude Security is Anthropic's beta code-scanning product, available in public beta for Claude Enterprise and as a plugin for all Claude Code users. It scans a codebase, validates findings, and proposes reviewable patches. The item is worth a note mainly because of a deployment split the summary glosses over: the two ways of running it do not use the same model.

Preconditions / Affected

The distinction that matters when deciding how to adopt it:

  • Claude Security app on Claude.ai (Enterprise): scans run on Claude Mythos 5.1, Anthropic's "most cyber-capable" model. You get Mythos-quality findings without direct access to the model. Admins enable it in the admin console.
  • Claude Security plugin for Claude Code: uses only the models available in your Claude Code account — not Mythos 5.1. If you run scans through the plugin expecting Mythos-quality results, you won't get them unless Mythos is in your account.
  • GitHub repos connected to the app are scanned with Mythos 5.1; validated findings return with confidence ratings and suggested patches you can open in Claude Code on the web.

What to do

  • To get Mythos 5.1 scans, use the Claude Security app on Claude.ai, not the plugin.
  • Admins: enable Claude Security in the admin console (see the getting-started guide).
  • Scope a scan to a specific directory, or configure scheduled recurring scans for ongoing coverage.
  • Push findings to Slack or Jira via webhooks; export as CSV or Markdown for tracking and audit. Documented dismissals carry forward, so triage decisions stay visible across tools.

Caveats

  • Public beta for both surfaces.
  • Anthropic states Claude can make mistakes; always review proposed patches before applying, especially for critical systems. Every patch requires human review and approval by design.
  • Focus is high-severity, context-dependent bugs (memory corruption, injection, auth bypass, complex logic errors spanning multiple files) — not a broad general-purpose linter. It reads Git history and traces data flows to reach these.

Technologies named here

Techniques named here

  • Context-aware static code analysis / data flow tracing
  • Adversarial self-verification of findings
  • Automated patch suggestion

Related in AppSec