Anthropic adds real-time vulnerability tracking to Claude Security

Continuous code monitoring

Anthropic has introduced an update to its Claude Security service that shifts how companies monitor their software for flaws. Instead of performing a single scan of a codebase, the tool now provides ongoing monitoring that tracks changes in real time.

Security teams can connect their repositories using the Claude GitHub app or access tokens from providers like GitLab. Once connected, the system runs a baseline scan and then performs recurring scans on new changes. These subsequent scans are prioritized based on the complexity and risk level of the specific code updates.

By constantly checking the code, the system ensures that security findings stay aligned with the current state of the software. This prevents the 'drift' that often happens when developers make rapid updates to a large project but security teams are still looking at old versions of the code.

Tracking fixes and regressions

One of the primary features of this update is the automated tracking of patches. When a developer submits a fix for a known vulnerability, Claude Security checks the code and marks the finding as resolved. This works regardless of whether the fix was created using Anthropic's own tools or external processes.

Crucially, the system also monitors for regressions. If a previously fixed vulnerability reappears in a new code commit, the tool automatically reopens the finding. This helps teams catch instances where a new update might have inadvertently reintroduced an old bug.

To help the AI understand the specific environment, teams can build a knowledge base for each project. This area allows engineers to document how the code is deployed, which specific security policies apply, and what information a new security engineer would need to know to understand the system.

Threat modeling and context

The service also generates a threat model based on the code provided. A threat model is a structured way of identifying potential attack vectors and the risks they pose to a system. Teams can review and edit these models to provide the AI with more context about their specific security goals.

Subsequent scans use this context to determine which issues to flag. For example, it can account for existing controls that might already mitigate a risk. This allows the tool to focus on what actually matters to the company rather than just providing a generic list of every possible flaw.

As Nathan Hunstad, Director of Security at Vanta, noted, the tool helped find logic flaws that other tools missed by focusing on what external users can actually reach. Each finding now includes a severity rating based on the project's specific threat model, along with an explanation of how an attacker might reach the vulnerable code.

Integration and access

Anthropic is making it easier for security teams to integrate these findings into their daily workflows. A new API allows for the management of projects and repositories, while webhooks can notify connected systems whenever a new finding is discovered.

Engineers can also use a Model Context Protocol (MCP) connector. This allows them to access findings directly within Claude.ai and Claude Code. From these interfaces, they can discuss specific issues with the AI, start the repair process, and mark findings as resolved in a single session.

The update includes new role-based access controls, which let administrators assign specific permissions for viewing projects or triaging findings. This ensures that different team members have the appropriate level of access based on their roles. The feature is currently in public beta for Claude Enterprise customers, who can enable it via the admin console.

How it works for teams

For a security team, the workflow begins by creating a project and linking multiple repositories. Because Claude Security can look across different repositories, it can detect issues that span multiple services, which is often difficult for traditional tools to see.

When a finding is identified, the system provides a diagram of the attack path. This visual representation helps developers understand exactly how a piece of code might be exploited. By combining these diagrams with severity ratings and automated tracking, the tool aims to help teams prioritize their most critical work first.

The goal of these updates is to provide coverage that stays current without requiring manual scheduling. By automating the discovery of new flaws and the verification of old fixes, security teams can spend less time on manual auditing and more time on high-level strategy.