Claude Code Security: Automated Vulnerability Detection at Scale
How Anthropic's security scanning tool found 500+ vulnerabilities in production codebases — and 22 in Firefox alone
What is Claude Code Security?
Claude Code Security launched on February 20, 2026 as a new capability built into Claude Code. It scans codebases for security vulnerabilities and suggests targeted patches for human review, catching complex issues that traditional rule-based tools miss. Using Claude Opus 4.6, it reads and reasons about code the way a human security researcher would.
The Numbers Speak
500+ Vulnerabilities Found
Anthropic's team used Claude Code Security to find over 500 vulnerabilities in production open-source codebases — bugs that had gone undetected for decades, despite years of expert review by security researchers.
The Firefox Pilot
In a landmark pilot with Mozilla, Claude surfaced 22 unique vulnerabilities in Firefox in just two weeks. 14 of these were high-severity, representing nearly 20% of the high-severity bugs typically found by the entire global research community in a full year.
How It Works
Unlike static analysis tools that match known patterns, Claude Code Security understands how components interact, traces how data moves through your application, and catches complex vulnerabilities that rule-based scanners miss. It evaluates security in context — understanding framework-specific protections and only flagging issues when those protections are missing or misconfigured.
Multi-Stage Verification
Every finding goes through a multi-stage verification process before reaching an analyst. Claude re-examines each result, attempting to prove or disprove its own findings and filter out false positives. Anthropic also deployed probes that measure activations within the model as it generates responses, with cyber-specific probes designed to track potential misuse.
What It Detects
- Injection vulnerabilities — SQL, XSS, command injection with cross-file data flow tracing
- Authentication & authorization flaws — Missing auth checks, broken access control, JWT misconfigurations
- Secrets exposure — Hardcoded credentials, overly permissive CORS, debug modes in production
- Memory safety issues — Buffer overflows, use-after-free in C/C++ codebases
- Logic vulnerabilities — Race conditions, TOCTOU bugs, improper error handling
Availability
Claude Code Security is available to Enterprise and Team customers. Open-source maintainers can apply for free, expedited access. Anthropic also released a GitHub Action for automated security review of pull requests.
Compared to Traditional SAST
Tools like Semgrep and CodeQL excel at known patterns but require rule maintenance and produce significant false positives. Claude Code Security complements these tools by catching logic-level vulnerabilities and providing human-readable explanations that help developers understand and fix issues faster.
Security is everyone's responsibility, but not everyone is a security expert. Claude Code Security bridges that gap by bringing expert-level vulnerability detection to every team.
References
Tags: Claude • Security • Vulnerability Detection