What is Claude Security, and why is it in the news?
Claude Security is Anthropic's service that reads a company's code and looks for security flaws. On 21 October 2026 Anthropic announced an update: checking stays on while the code changes, and every finding is tracked until it is fixed. In its post on Claude Fable and Mythos 5.2, published on 9 November, Anthropic adds that Claude Security now uses Mythos 5.2 too.
The signal comes from the company's own numbers. According to Anthropic, since the beta opened in April thousands of organisations have used it and found over a million vulnerabilities. That is the vendor's figure, with no independent check.
How does it work, in practice?
- You connect your repositories, meaning the archives that hold your code, from GitHub, GitLab or other services, and choose which branch to check.
- Claude runs a first full scan. After that it checks changes regularly, based on their risk and complexity.
- Each finding has a severity rating and explains how an attacker could reach the weak spot, sometimes with a diagram.
- Each finding comes with a suggested fix, which a person reviews and approves. When the fix reaches the code, the flaw is marked closed. If it comes back, it reopens on its own.
- Findings reach your ticketing tools through an API, or show up inside Claude and Claude Code as an MCP connector.
Your team can also describe, in a dedicated space, how the software is deployed and which rules apply. Claude Security turns that into a threat model your team can edit, and uses it to decide what to flag. Admins decide who can see projects and who handles findings.
What can it do for a business or a public body?
- A company with a custom customer portal, where the supplier ships changes every week. The check follows every release, not just the year-end review.
- A public body with an online service for citizens' applications, built by several suppliers. One project can hold several repositories, so the check also sees problems between one service and another.
- An IT team that already uses a ticketing system. Flaws arrive there as tasks, with severity and a suggested fix, and whoever closes them leaves a record.
What doesn't it do (yet)?
It does not fix things on its own. Anthropic writes that every fix needs a person to review and approve it, and that Claude can make mistakes. It is in public beta and only for Claude Enterprise customers. Scans with Mythos models run only in the Claude Security app on Claude.ai, while the Claude Code plugin uses the models in your account.
Our read: the tool finds and suggests, but it does not decide who closes the flaw. Who gets the alert, who approves and how fast you act are still your choices.
What about us?
Anthropic is one of the model providers we build with, as our Partners page says. We have no Claude Security case of our own to cite, so here is how we would use it.
On the code we deliver, we would connect findings to the client's ticketing system, with an owner for each severity level. Suggested fixes would go through the same review as any other change. Our Security page says every update can be reviewed and reversed.
Should you try it or wait?
- If you already have Claude Enterprise and your own code in production, try it on one project and count how many findings are useful to you.
- If a supplier writes your code, ask who receives security findings and how fast they close them, whatever the tool.
- If nobody owns the flaws in your code, name an owner before you switch on any scanner.
“A scanner pays off when every flaw has a name next to it and a closing date.”
DBrothers — our read on Claude Security
Frequently asked questions
Do you need Mythos access to use it?
No. Claude Security uses Anthropic's full family of models, Mythos included, without joining the Cyber Verification Program.
Does it only work with GitHub?
No. It connects through the Claude GitHub app, including GitHub Enterprise Server, or with an access token for GitLab and other Git providers.
Who can see the findings?
Admins decide. The new access controls set who can view projects, who can triage findings and who can create new projects.
Take the last ten security findings on your code and check who closed them and when. If names or dates are missing, that's where we start.
