Anthropic's October 21, 2026 update turns Claude Security into a scanner that never stops. It runs a deep baseline scan, re-scans changes based on risk and complexity, closes findings when fixes land in any tool, reopens them if they regress, and judges severity against a per-project threat model that your team edits. Findings flow out through a new API, webhooks and an MCP connector for Claude.ai and Claude Code, with role-based access control for larger rollouts. Anthropic says it runs on its full model family "including Claude Mythos, with no Cyber Verification Program access required," and that customers have found over a million vulnerabilities since the April beta.
For security teams the question is not whether AI code scanning works; Anthropic's own customers report findings a concurrent pen test missed. The question is where it fits, what it cannot see, and how to govern a tool that reads your code and, through MCP, lets agents resolve findings. This post covers those three. For a plain-English product overview, see explainx.ai's Claude Security update explainer.
TL;DR
| Question | Answer |
|---|---|
| What is new | Continuous scans, fix tracking, threat model, knowledge base, attack paths, API, webhooks, MCP, RBAC |
| Best at | Logic flaws, authn/authz mistakes, cross-service trust issues, prioritization by reachability |
| Not a replacement for | SCA, secret scanning, supply chain controls, runtime detection |
| Access needed | Repo read via GitHub app or provider token; PATs scoped to the user |
| Governance risk | Agents can resolve findings through MCP; scope tokens and review closures |
| Availability | Claude Enterprise public beta; $25K/month credits for two months |
What changed, mechanically
| Capability | How Anthropic describes it | Why it matters |
|---|---|---|
| Continuous scanning | Baseline, then change scans prioritized by "risk and complexity" | Findings stay current without scheduling |
| Multi-repo projects | Catches issues "between services, like a backend that trusts input a client was supposed to validate" | Cross-service trust bugs are where single-repo SAST is weakest |
| Fix tracking | Closes findings when fixes land anywhere; reopens on recurrence | Backlog reflects reality; regressions surface |
| Knowledge base | Deployment, policies, "anything a new security engineer would need to know" | Suppresses risks your controls already handle |
| Threat model | Generated from code, editable; drives what gets flagged | Prioritization by your risk policy, not generic severity |
| Exploit paths | Severity against the threat model, reachability explanation, optional diagram | Fix what is reachable first |
| API | Projects, findings, resolve/reopen, repos | Pipelines, dashboards, SLAs |
| Webhooks | New-finding notifications | Slack, Jira, SOAR |
| MCP connector | In Claude.ai and Claude Code: open, discuss, fix and resolve in one session | Remediation in the developer's flow |
| RBAC | Who views, triages, creates projects | Wider rollout without wider admin |
Where it fits next to your existing tools
| Control | Catches | Claude Security's role |
|---|---|---|
| SAST (rule-based) | Known code patterns, fast, deterministic | Complements: finds logic and context-dependent flaws rules miss; keep SAST as a gate in CI |
| SCA / dependency scanning | Known CVEs in dependencies | Not a replacement; keep it |
| Secret scanning | Leaked keys and tokens | Not a replacement; keep it |
| Supply chain controls | Malicious releases, compromised maintainers, tampered binaries | Not covered; October's incidents arrived through trusted packages |
| DAST and pen tests | Runtime behavior, deployment misconfig | Overlaps on reachability reasoning; IonQ reports findings a concurrent pen test missed, but keep tests |
| Runtime and agent monitoring | What actually executes, including AI agents | Not covered |
The example in Anthropic's launch image is telling: "The token filter accepts bearer tokens that carry no signature," so "one forged token is a sign-in as any customer, or as an administrator." That is a logic flaw in how a check is wired, the class of bug that pattern-based scanners routinely miss and that an attacker with an AI model can now find quickly.
What it does not cover
- Malicious dependencies and releases. LiteLLM 1.107.0, Tensorlake 0.5.144,
@subql/common5.8.3 and the OVHcloud CLI binaries were all compromised upstream. Scanning your repositories does not detect a poisoned package you install. Pin by version and digest, use provenance checks, and keep SCA. - Secrets already leaked. A scanner may flag a hard-coded key, but rotation and secret scanning across history are separate jobs, as GhostAction showed.
- Deployment state. The threat model is written from code; Anthropic's docs note it can miss deployment context. The knowledge base helps, but runtime configuration is not code.
- What agents do at runtime. Code scanning says nothing about what a coding agent runs on a developer machine or in CI.
Governing the tool itself
A scanner with read access to every repository and an MCP connector that can resolve findings is a privileged system. Treat it like one.
- Scope repositories and branches. Connect what you intend to scan, not the whole org by default. Prefer the GitHub app with explicit repository selection.
- Use RBAC. Give most engineers view and triage, and keep project creation with security.
- Scope personal access tokens. Anthropic says PATs "can only see and change what the user can." Use service accounts with least privilege for automation, and set expiry.
- Review resolutions. Through MCP, a developer's agent can start a fix and mark the finding resolved in one session. Claude Security re-checks changed code and reopens regressions, but decide whether agent-initiated resolutions need a second human review for critical and high findings.
- Watch the webhooks. Findings include exploit paths. Route them to restricted channels, not a public Slack.
- Version the threat model. It now drives what gets flagged. Edits that downgrade a risk should be reviewed like a policy change.
On developer machines, Beam records the MCP tool calls coding agents such as Claude Code make, along with their shell commands and file access, which gives you an audit trail of which findings an agent touched and what it changed.
A two-month evaluation plan
The $25,000 monthly credits for two months, through December 31, 2026, are enough for a serious pilot.
Weeks 1 to 2: pick three projects: one internet-facing API, one multi-repo service pair, one legacy codebase. Write the knowledge base and review the generated threat model with the owning team.
Weeks 3 to 6: let continuous scans run. For each finding, record true or false positive, severity agreement, reachability accuracy and time to fix. Compare against your SAST results and the most recent pen test.
Weeks 7 to 8: measure automatic closure accuracy (did fixed findings close, did regressions reopen), credit burn per project, and developer adoption of the MCP flow. Decide on rollout scope and the human-review rule for resolutions.
Questions to answer before buying: true-positive rate by severity, cross-service findings your other tools missed, false closures, cost per useful finding, and how the threat model held up after edits.
Why the timing matters
October 2026 showed AI on both sides of the vulnerability race: PHP2Shell found with AI and attacked before its patch, GitLab's CVSS 10 regex flaw, and ransomware run through coding agents. OpenAI expects AI-found vulnerabilities to "increase sharply." Continuous, context-aware scanning of your own code is the right response for the code you write. It has to sit next to supply chain controls and runtime monitoring for the code you trust and the agents you run.
Related reading
- Black October 2026: every supply chain incident
- AI-led attacks in October 2026
- Cloudflare's security audit skill for coding agents
- Trail of Bits regression hunt and patching skills
- MCP server security review
Primary source: Anthropic: Claude Security now scans continuously and tracks fixes. Hero image: Anthropic.
Accurate as of October 22, 2026. Claude Security is in public beta; capabilities and terms may change.