Claude Security adds ongoing scans and automatic fix tracking

Security findings follow the code after the first scan

Anthropic updated Claude Security on October 21 with ongoing repository monitoring, automatic tracking of completed fixes, and an API and Model Context Protocol (MCP) connector for working with findings in other tools. The release remains a public beta for Claude Enterprise customers. Its practical promise is to keep a security backlog aligned with software as engineers change it.

The earlier public beta, announced April 30, already offered scheduled scans, checks focused on a directory or branch, documented dismissal reasons, exports and webhooks. It used Opus 4.7 to examine code and generate proposed repairs. That history matters: October’s release extends an existing scanning service rather than introducing automated security review for the first time. The new emphasis is on maintaining findings between the initial discovery and a completed repair.

Source 1Source 5

Seat requirements depend on the Enterprise plan

Anthropic’s access guidance conflicts as of October 21. Its Security help page specifies Premium seats and enabled usage credits; the linked Academy guide instead requires a seat that includes Claude Code. The seat documentation says new and self-serve Enterprise seats include Claude Code. Older Enterprise plans use Chat + Claude Code seats under usage billing or Premium seats under seat billing. Together, these documents do not establish a universal Premium-seat requirement.

Academy makes enabling usage credits a setup step for plans with Standard and Premium seats; other Enterprise plans follow their own billing arrangements. Administrator activation remains necessary. Because the pages disagree, administrators should confirm their organization’s configuration before rollout. Claude Code access on a Team plan does not establish eligibility for this Enterprise service.

Source 2Source 3Source 7

Projects bring related repositories and deployment context together

Repository permissions are also required. GitHub access uses the Claude GitHub App; other Git providers can connect through a repository address and authorization token. Projects support up to eight repositories, including those used only for context, with branch and folder controls. A deep initial scan establishes the baseline.

Anthropic also gives projects a knowledge base and an editable threat model: a description of the system, its exposure and the attacks that matter. Teams can supply deployment details that source code alone cannot establish. The model then helps determine which findings deserve attention.

For a backend and its client app, grouping both repositories lets the scan trace issues across the pair. Anthropic’s announcement gives a concrete target: a server trusting input that the client was meant to validate. This illustrates the intended use, not a vulnerability we found in testing.

Source 1Source 2Source 3

Tracking a repair does not mean approving it

After the baseline, scans follow changes according to their risk and complexity; the help documentation specifies no fixed timetable. Anthropic says the service checks whether repairs have landed and can reopen an issue if it appears again. Suggested patches still require human review and approval.

The API lets teams retrieve findings and update their status, supporting integrations with ticketing and vulnerability-management systems. The MCP connector brings findings into Claude and Claude Code, where an engineer can investigate and work on a repair. The useful consequence, in our analysis, is less manual copying between a scanner’s backlog and the tools where engineers resolve it.

Anthropic says hosted scans use models including Mythos without requiring Cyber Verification Program access. That provides findings from the managed service, not unrestricted access to the underlying model. The vendor also warns that Claude can make mistakes.

Source 1Source 2Source 4

Usage credits have a running clock

The setup guide says billing is at direct token cost, with no additional platform fee. Costs vary with repository size and change frequency, and administrators can set a separate spending limit for Claude Security.

Eligible Enterprise organizations receive up to $25,000 in usage credits monthly for two consecutive months, without rollover. Existing organizations’ periods start October 21, even without use; later customers’ periods start at signup. The December 31 UTC cutoff means signups after November 1 cannot receive two full months. New and migrated projects qualify; unmigrated projects do not. Token charges apply after credits are exhausted or expire.

Source 2Source 3

Existing users have migration work to account for

Existing projects keep running. Migration copies findings into a new project and archives the original, but excludes members, webhooks, excluded directories, scan history and scheduled scans. GitHub Enterprise projects cannot migrate. Hosted Claude Security lacks zero data retention. Scanning requires ownership and scanning rights; unrelated third-party repositories are excluded.

Teams should also distinguish this hosted update from the separate Claude Security plugin for Claude Code. The plugin runs scans inside a Claude Code session, uses the account’s available models and requires the session to remain open. It supports repository or change-focused investigations and produces patches for the user to apply. It is a different operating model from a hosted service watching connected repositories.

That distinction also separates this release from Claude Code Review, which examines pull requests. The October update addresses the ongoing vulnerability backlog; it does not establish that an AI scan can replace every other security check.

Source 2Source 6