6Anthropic News·
Government of Alberta deploys Claude Code to scan 466M lines of code for cybersecurity vulnerabilities in 20 hours
The Government of Alberta's Ministry of Technology and Innovation has used Claude Code with Opus and Sonnet models to conduct a large-scale security review of its 1,280 applications and 3,400 code repositories, scanning 466 million lines of code in approximately 20 hours using ~50 parallel agents. The team remediated vulnerabilities, rebuilt legacy systems (including a 25-year-old Java subsidy portal rebuilt in 4-5 days), and deployed continuous red/blue team review agents built on the Claude Agent SDK. Alberta has published technical white papers documenting the approach for other governments to replicate.
Related guides (5)
Enterprise Deployment PatternsTopic guide
Enterprise Deployment Patterns: How Organizations Are Moving LLMs from Demo to Production
Read asIn-depth
Related events (8)
Anthropic Launches Claude Code Security: AI-Powered Vulnerability Detection for Defenders
Anthropic has released Claude Code Security in limited research preview for Enterprise and Team customers, a capability built into Claude Code that scans codebases for security vulnerabilities and suggests patches for human review. Unlike rule-based static analysis tools, it uses Claude's reasoning to understand code context, trace data flows, and detect complex vulnerabilities including novel ones. Built on Claude Opus 4.6, the system found over 500 previously undetected vulnerabilities in production open-source codebases during internal research. The release is framed as a defensive measure to put AI-enabled vulnerability discovery in the hands of defenders before attackers can exploit the same capabilities.
Anthropic releases claude-code-security-review GitHub Action for automated security analysis
Anthropic published an open-source GitHub Action that uses Claude to automatically analyze code changes for security vulnerabilities as part of CI/CD workflows. The tool integrates directly into GitHub pull request pipelines. With 5,157 stars, it has attracted meaningful community interest as a practical agentic coding security tool.
claude-bug-bounty: autonomous bug bounty hunting tool built on Claude Code
A Python tool on GitHub integrates Claude Code to automate bug bounty hunting workflows from the terminal, covering reconnaissance, 20 vulnerability classes, autonomous hunting, and report generation. The project has accumulated 2,745 stars with 203 added today, indicating significant community traction. It represents a concrete agentic use case of Claude Code for offensive security automation.
Anthropic Frontier Red Team reports early-warning signs of rapid AI progress in cybersecurity and biosecurity capabilities
Anthropic's Frontier Red Team published findings from a year of safety evaluations across four model releases, documenting rapid capability gains in dual-use domains. In cybersecurity, Claude 3.7 Sonnet now solves roughly a third of Cybench CTF challenges (up from ~5% a year ago), and with the Incalmo toolset was able to replicate a large-scale network attack in realistic cyber range environments. In biosecurity, Claude has moved from underperforming virology experts to exceeding them on the VCT benchmark within one year, and exceeds human expert baselines on cloning workflows. Anthropic assesses current models as showing 'early warning' signs but not yet crossing thresholds of substantially elevated national security risk.
Claude Opus 4.6 Discovers 22 Firefox Vulnerabilities in Two-Week Mozilla Partnership
Anthropic's Claude Opus 4.6 identified 22 vulnerabilities in Firefox over two weeks in February 2026, of which Mozilla classified 14 as high-severity—representing nearly a fifth of all high-severity Firefox vulnerabilities remediated in 2025. The collaboration grew from internal evaluations showing Opus 4.5 was near-saturating CyberGym, a benchmark for LLM security capability, prompting Anthropic to test against a harder real-world target. Claude scanned nearly 6,000 C++ files and submitted 112 unique reports, with most issues patched in Firefox 148.0. The effort also included an evaluation of Claude's ability to write primitive exploits, probing the upper limits of AI-enabled offensive security capability.
Anthropic launches bug bounty program to stress-test ASL-3 Constitutional Classifiers
Anthropic launched an invite-only bug bounty program in partnership with HackerOne to find universal jailbreaks in its Constitutional Classifiers system before public deployment, offering up to $25,000 per verified vulnerability. The program targets CBRN-related safety bypasses on Claude 3.7 Sonnet and is part of Anthropic's work to meet its AI Safety Level-3 (ASL-3) Deployment Standard under its Responsible Scaling Policy. A follow-up update extended the program to test Constitutional Classifiers on the new Claude Opus 4 model and began accepting reports of universal jailbreaks found on public platforms. The initiative reflects Anthropic's structured approach to pre-deployment safety validation for increasingly capable models.
Claude Code 2.1.210 release: bug fixes, security hardening, and agent workflow improvements
Anthropic released Claude Code version 2.1.210, a substantial patch addressing over 30 bugs and adding several improvements to the agentic coding tool. Notable fixes include hardening against indirect prompt injection via subagent-read content, correcting git worktree isolation for subagents, fixing hook callback timeouts that caused unattended sessions to stall, and resolving MCP server teardown during mid-session re-syncs. The release also improves auto-mode permission classification by defaulting to Sonnet 5 for external sessions and adds UX enhancements for the multi-agent dashboard.
Anthropic Details Collaboration with US CAISI and UK AISI on Constitutional Classifier Red-Teaming
Anthropic has published an account of its ongoing voluntary partnership with the US Center for AI Standards and Innovation (CAISI) and UK AI Security Institute (AISI), in which government red-teamers were given deep access to pre-deployment versions of Constitutional Classifiers used on Claude Opus 4 and 4.1. The collaboration uncovered multiple vulnerability classes including prompt injection bypasses, cipher-based obfuscation attacks, universal jailbreaks via automated attack refinement, and input/output fragmentation exploits, each of which drove architectural improvements to Anthropic's safeguard systems. Key lessons shared include the value of providing unprotected model variants, real-time classifier score access, and detailed internal documentation to enable targeted red-teaming. The announcement frames government partnership as a core component of Anthropic's Safeguards approach rather than a one-off audit.