Claude code security enters research preview to help teams tackle hidden software flaws
Claude Code Security has been introduced in a limited research preview, offering organisations a new way to scan codebases for vulnerabilities and propose targeted patches for review. Built into Claude Code on the web, the tool is aimed at helping security teams identify issues that conventional testing methods often miss.
The release comes as many organisations struggle with mounting backlogs of unresolved software weaknesses. Rule-based static analysis tools remain widely used, but they typically search for known patterns. That approach can flag exposed credentials or outdated encryption, yet it often fails to catch more complex weaknesses such as flawed business logic or broken access controls. These are the kinds of issues that attackers frequently exploit and that require careful human scrutiny to uncover.
Claude Code Security takes a different route. Rather than matching code against a database of known flaws, it analyses how components interact and how data moves through an application. The system then suggests specific patches, which are reviewed and approved by developers before anything is changed. Each finding is re-examined through a multi-stage verification process designed to reduce false positives. Results are assigned severity and confidence ratings so teams can prioritise their work.
The company behind Claude says the tool builds on more than a year of research into the model’s cyber defence capabilities. Its internal red team has tested the system in competitive Capture the Flag exercises and in projects with external partners, including the Pacific Northwest National Laboratory. According to the company, recent testing with Claude Opus 4.6 uncovered more than 500 vulnerabilities in production open-source codebases, some of which had remained undetected for years. Maintainers are being contacted as part of a responsible disclosure process.
The launch arrives at a moment when artificial intelligence is beginning to reshape both sides of the cybersecurity equation. While AI can help defenders locate and repair weaknesses at scale, it may also equip attackers with faster ways to find entry points. The company acknowledges this tension, stating that the goal is to ensure such capabilities are placed in the hands of those working to secure systems rather than exploit them.
Access to Claude Code Security is initially limited to Enterprise and Team customers, with expedited entry offered to maintainers of open-source repositories. Participants in the preview will work directly with the development team to refine the product before a wider release.
For organisations weighing adoption, the promise is clear: deeper analysis of complex codebases combined with human oversight. Whether it can meaningfully reduce the volume of exploitable flaws across the industry will depend on how effectively it integrates into existing security workflows and how quickly defenders adapt to a rapidly changing threat environment.