Anthropic’s Claude Security plugin enters beta, bringing a multi-agent AI vulnerability scanner directly into Claude Code. Instead of automatically fixing issues, it verifies vulnerabilities through independent AI reviewers before generating optional patch files. The plugin emphasizes trust, transparency, and developer oversight, making it a strong companion to traditional SAST and manual security reviews rather than a replacement.
Anthropic has launched the Claude Security plugin for Claude Code in beta. It brings a multi-agent vulnerability scanner directly into an existing terminal session. The plugin adds a single slash command, which turns Claude Code into a repository auditor. From there, it converts selected findings into patch files for manual review.
That distinction matters. Most AI-assisted security tools flag issues without proving they’re reachable. Others auto-apply fixes without independent review. Claude Security does neither. Instead, it separates finding a vulnerability from verifying it, and separates verifying a vulnerability from patching it. Different agents own each stage.
Why It Matters
Vulnerability scanning has usually meant a trade-off. Static analysis is fast but noisy, while manual review is accurate but slow. An LLM-based scanner promises both speed and precision. However, that promise only holds if false positives stay low. Otherwise, a report full of unreachable “vulnerabilities” simply trains developers to ignore it.
Claude Security tackles this directly. Every finding must clear a structured verification panel before it reaches the report. As a result, teams already running Claude Code get a repeatable security pass added to an existing workflow. Still, Anthropic is clear that the plugin supplements a SAST platform rather than replacing one.
Technical Details
The command /claude-security opens three jobs. First, it can scan a full codebase or a scoped subset. Second, it can scan a diff — a branch, a pull request, or a single commit. Third, it can turn report findings into .patch files. Installation takes two commands through Anthropic’s official plugin marketplace, and the source is public in the claude-plugins-official repository, currently at version 0.10.0.
Under the hood, a JavaScript-orchestrated workflow drives the scan across six phases: inventory, threat modeling, research, gap-filling sweeps, adversarial panel review, and — at maximum effort only — a re-panel and red-team pass on marginal findings. Research covers four fixed categories: injection-and-input, auth-and-access, memory-and-unsafe, and crypto-and-secrets. Notably, the system drops the memory-safety lens automatically for components written entirely in memory-safe languages.
Effort scales across four tiers: low, medium, high, and max. Higher tiers raise the component cap from 12 to 24, add a second researcher per matrix cell, and allow up to two gap-fill sweeps. For small diffs, though, the process skips the full matrix and uses a single-researcher pass instead, which keeps cost proportionate to scope. The agents are model-tiered too: the orchestrator runs on Opus, while the cartographer and code explorer run on Sonnet. Meanwhile, all scan agents get read-only tools only.
Performance & Evidence
The core engineering claim is simple: a finding earns its confidence rating rather than having it asserted. To that end, each candidate goes to three independent verifiers — one checks reachability, one checks impact, and one checks defenses. Each verifier returns a true-positive or false-positive verdict with a supporting file and line reference. A finding needs a 2-of-3 keep quorum to survive; fewer than three returned votes disqualifies it outright.
The panel outcome also caps the finding’s stated confidence. Unanimous agreement allows a “high” ceiling, whereas a 2-of-3 split caps confidence at “medium.” Notably, the report renderer computes this tally in Python, not the model. A revision file only claims “verified” status when the vote record shows the panel ran on every listed finding. Because of that, the report’s rigor becomes auditable rather than something users take on faith. Even so, independent testing will still need to confirm how this holds up against real-world codebases and adversarial edge cases.
Pricing & Availability
The plugin requires a paid Claude Code plan, version 2.1.154 or later. Users must also enable dynamic workflows in /config. Additionally, it needs Python 3.9.6 or later (standard library only) and Git for diff scanning and patch generation. Anthropic supports Linux, macOS, and Windows, and scan usage counts against a plan’s existing token limits. So far, Anthropic has not disclosed separate pricing for the plugin itself.
Industry Implications
For individual developers and small teams, this lowers the barrier to a structured security pass, since teams no longer need a dedicated SAST or code-review product to get one. Meanwhile, Anthropic positions the plugin as one tier in a broader stack: a lightweight in-session guidance plugin covers code Claude writes, /security-review handles a single-pass check, Claude Security runs deep local scans, Code Review adds pull-request-level checks on Team and Enterprise plans, and a managed Claude Security offering handles continuous monitoring. Seen this way, the plugin doesn’t replace CI-based SAST and dependency scanning. Instead, it pulls similar rigor earlier into the developer’s own terminal.
Limitations & Open Questions
Anthropic is upfront about several constraints. For one, the scan runs under the user’s own permissions and adds no isolation of its own, so any committed .claude/ settings, hooks, or CLAUDE.md instructions still apply during a run. The plugin also treats repository content as data rather than executable instructions, but Anthropic does not present that as a defense against a genuinely hostile codebase. Because of this, it recommends sandbox-runtime for scanning unfamiliar repositories.
Scans are also explicitly nondeterministic. Beyond that, patches only get written when an independent verifier can vouch for three claims at once: the fix addresses the specific finding, it introduces no new vulnerability, and it leaves behavior otherwise unchanged. Consequently, anything that weakens security to “fix” it gets an automatic reject, whether that’s a loosened auth check or a disabled test. When no repository test covers a patched section, the tool says so rather than implying confidence it doesn’t have.
Future Outlook
LLM-based security tools have long struggled with one gap: they can flag an issue, but they can’t easily prove it’s real and worth fixing. Claude Security’s panel-and-quorum structure targets that gap directly, as does its report-renderer-computed verification, which skips model self-attestation entirely. Ultimately, though, whether this approach holds up depends on real-world numbers. For that, independent researchers and larger engineering teams will need to test it against production repositories, not just Anthropic’s own benchmarks.
Conclusion
The beta release stands out less for the scan itself and more for how it structures trust. Findings must survive adversarial verification before they reach the report, and patches must clear a three-part review before they reach disk. Nothing gets applied automatically at either stage. Overall, that’s a more conservative design than “AI finds and fixes bugs” — and likely a more defensible one. Even so, developers should treat it as a complement to existing SAST, dependency scanning, and manual review, not a replacement. Independent benchmarking will therefore be worth watching as the plugin moves toward general availability.