How Anthropic Secures its AI-Native SDLC

What it is

A strategy piece by Anthropic's Deputy CISO on securing an SDLC where Claude authors ~80% of merged code. Beyond the tooling the summary lists, the article states an explicit threat model and a set of transferable "enduring principles," and it is framed as a companion to Anthropic's separately published Zero Trust for Agents framework — every control in the article is said to use design ideas from it.

The threat model it designs against

The piece names three specific threats and states that every control maps to at least one:

• a compromised or prompt-injected agent introducing a malicious change;
• supply-chain / dependency poisoning that an agent ingests as trusted input;
• familiar application-vulnerability classes now arriving at higher volume.

What's actionable beyond the summary

• The /security-review gate moved. Originally the CLAUDE.md instructed the agent to run /security-review as a final step before opening a PR. The article states these reviews now run while Claude generates the code, not just at the end — a shift-left within the generation loop itself.
• Self-approval gate. Once the team gained confidence in Claude's risk assessments, they let teams approve their own project if the PSR deemed the launch low enough risk — the human AppSec gate is removed for low-risk items. This "saved the majority of the AppSec team's time."
• Why architectural review was demoted. The PSR existed to catch issues before expensive coding. Because multiple prototypes of a major feature can now be built in hours, detailed architectural review is treated as a less critical gate — the rationale for relocating context-gathering rather than gating on documentation.
• Enduring principle — bring agents to the context, not the reverse. As planning cycles compress, connect security agents to where context already lives (chat threads, prior reviews, the codebase) via a Claude Code skill that fans out, rather than forcing detailed documentation at stages that may no longer need it.
• Scale figure: engineers ship ~8x as much code per quarter as in the 2021–2025 baseline; the driving concern is Amdahl's Law — security review becoming the serial bottleneck.

Caveats

This is a principles-and-approach narrative, not an advisory: no versions, no reproduction steps, and no code for the PSR or the knowledge-index integration. The only generally-available artifact is the /security-review command; the PSR web app, knowledge index, and Claude Tag are internal. The author concedes the model is non-deterministic and "that doesn't mean all code comes out perfect" — the controls are compensating layers, not guarantees. The fetched text is also truncated mid-sentence, so the final section on the closed guidance loop is incomplete.