Claude Security Guide

Claude Security is Anthropic’s AI tool for finding security vulnerabilities in code. It reads a codebase the way a human security researcher would, following data flows and business logic, then proposes fixes for a person to review.

A scanner finds patterns. Claude Security tries to understand how your code can actually break.

Since August 21, 2026, Claude Security scans can run on Claude Mythos 5, Anthropic’s most capable security model. You get structured findings, not direct access to the model, and the scan does not extend Mythos access anywhere else.

Managed Claude Security

Public beta for eligible Claude Enterprise customers

Local Claude Code plugin

Beta for paid Claude Code plans, using the models your account already has

Mythos 5 scans are billed as standard usage on your Enterprise plan. Check Anthropic’s current terms before you plan budgets.

• An Enterprise admin enables Claude Security in the admin console
• Connect your GitHub.com or GitHub Enterprise Server repositories
• Go to claude.ai/security
• Pick a repository and start a scan

• Runs locally inside a Claude Code session
• Scans GitHub, GitLab, Bitbucket, a plain folder, or a single diff
• Exports results as Markdown, JSONL, or SARIF
• Does not use Mythos 5 managed scans

CWE

The type of weakness, such as injection or broken access control

Severity

How bad it would be if exploited

Confidence

How sure Claude is that the issue is real

Suggested fix

A proposed patch to review

Start with high-severity, high-confidence findings.

• Open the finding in Claude Code on the web to work on a fix
• Patches are never applied automatically
• Review and test every patch before merging
• Add a test that proves the bug is gone

• Run targeted scans on risky modules
• Schedule regular scans
• Export to CSV or Markdown
• Send results by webhook to tools such as Slack or Jira

• Scan only code you own or are allowed to test
• Results can vary between runs, and no scan proves full coverage
• Large repositories can take hours, so scan by module
• Suggested patches can be wrong

Claude Security does not replace static analysis, dependency and secret scanning, or penetration testing. Use it as an extra layer that catches logic flaws other tools miss.

• Start with one important repository
• Triage findings with a security engineer
• Track how many findings were real
• Expand to more repositories once the process works