Translated from the original Japanese article
Tech 6 min read

Claude Code Security’s AI inference–based vulnerability detection

Anthropic Claude Security SAST AI GitHub Actions Vulnerability Detection

On February 20, 2026, Anthropic announced Claude Code Security as a limited research preview. Built on Claude Opus 4.6 and released in partnership with Pacific Northwest National Laboratory (PNNL), it follows more than a year of red‑teaming and CTF validation.

Anthropic says it has discovered over 500 vulnerabilities in OSS codebases running in production, including bugs that had “gone undetected for decades.” It’s available to Enterprise and Team plan users, with a free priority‑access application track for OSS maintainers.

Note that scanning is limited to code you own; scanning third‑party or OSS code is contractually prohibited.

How it differs from traditional SAST

Conventional static analysis tools rely on rule‑based scanning of known vulnerability patterns. They predefine patterns such as “user input is directly concatenated into an SQL query,” and flag matching code. Vulnerabilities not captured by rules, logic issues spanning multiple components, and cases involving complex, intertwined data flows are easy to miss.

Claude Code Security tackles the problem from a different angle. Anthropic describes it as “reading and analyzing code like a human security researcher rather than scanning for known patterns.” It understands interactions across components, traces data flows within the application, and even analyzes Git history to detect complex vulnerabilities that rule‑based tools tend to miss.

What kinds of vulnerabilities it can detect

The scope is broad: memory corruption; various injections (SQL, command, LDAP, XPath, NoSQL, XXE); authentication bypass; complex logic errors; broken access control; unsafe deserialization; SSRF; secret leakage; weak cryptography; XSS; and race conditions (TOCTOU). These include categories that are hard to catch with simple pattern matching.

How it reduces false positives

One of the biggest practical problems with security tools is false positives. If a tool keeps reporting non‑issues as vulnerabilities, developers start ignoring alerts and risk overlooking real problems.

Claude Code Security uses a multi‑stage validation process:

  • Adversarial verification path: After finding an issue, it challenges itself with “Is this really a vulnerability?” and attempts to both prove and disprove the finding.
  • Severity rating and confidence score: Each finding carries both severity and confidence to aid prioritization.
  • Automatic exclusions in the GitHub Action: DoS issues, rate‑limiting problems, memory/CPU exhaustion, input‑validation gaps without demonstrated impact, and open redirects are automatically excluded.

However, no concrete false‑positive rate has been published. VentureBeat asked, but Anthropic declined to share figures. Saying “we have mechanisms to reduce false positives” without numbers remains a concern for evaluators.

GitHub Action

Released as anthropics/claude-code-security-review (MIT license). It performs diff‑aware scans per PR and automatically posts security‑review comments on the changes. It is language‑agnostic.

That said, the official repository warns it is not hardened against prompt‑injection attacks. If a PR embeds a prompt injection, the review outcome could be manipulated. It’s an ironic situation where a security tool’s own security remains unresolved.

Comparison with competing tools

Claude Code Security competes with existing security tools but takes a fundamentally different approach.

ToolApproachFix suggestionsCharacteristics
Claude Code SecurityAI inference‑based (reads the whole codebase like a human researcher)Patch suggestions (human approval required)Data‑flow tracking, Git history analysis, multi‑stage self‑verification
Snyk CodeHybrid of AI + pattern matchingReal‑time fix suggestions in IDEIntegrated SAST + SCA + containers + IaC
GitHub CodeQLSemantic query language (focused on taint analysis)Suggestions via Security AlertsStrong at taint analysis
SemgrepSemantic pattern matching (YAML rules)Rule‑based auto‑fixesFast, OSS‑based
SonarQubeRule‑based static analysisCode quality + security combinedIntegrates quality checks with security

In practice, a pragmatic setup is to use Semgrep to filter known patterns and add business‑logic checks with Claude Code Security. It’s not a replacement for every tool; it fills coverage gaps in existing stacks.

Claude Code Security isn’t the only entrant. AI‑native security analysis is rapidly becoming a market.

  • Endor Labs: Raised $93M in April 2025; claims a 92% reduction in false positives.
  • Qwiet AI: Three‑agent pipeline (analysis, fix, verification) to automate vulnerability handling.
  • Pixee: Acts as an AI product security engineer and automatically generates fixes.
  • DryRun Security: Enforces security policies per PR.

Anthropic’s entry puts a major LLM vendor directly into this market—something specialized startups can’t ignore.

Market reaction: $15B erased from cybersecurity stocks

Immediately after the announcement, around $15B was wiped from cybersecurity‑related market caps.

  • JFrog: -25%
  • Okta: -9.2%
  • CrowdStrike: -8%
  • Cloudflare: -8.1%

Even so, most analysts called it an overreaction. Barclays said “the selloff is illogical,” Morningstar called it “not bad news,” and Viola Ventures noted that “security doesn’t get easier; it gets harder.”

Claude Code Security may replace a slice of SAST, but it targets a different layer than CrowdStrike’s EDR or Okta’s IAM. Much of the selloff seems tied to a simplistic association that “AI will do all of security.” Viewed soberly, the better AI gets at finding vulnerabilities, the more demand grows for security products and services.

Concerns and criticisms

Dual‑use problem

The inference capability that finds vulnerabilities can also aid attackers’ reconnaissance. As such tools improve, the race intensifies: will defenders or attackers find issues first? Anthropic limits scanning to customer‑owned code, but other models with comparable inference power exist.

Security of AI applications themselves

Repello AI points out that it “does not secure the AI application itself.” Problems specific to LLM apps—prompt injection, indirect prompt attacks, and the reliability of model outputs—are outside Claude Code Security’s scope.

Prompt‑injection unaddressed in the GitHub Action

As noted, the GitHub Action is not hardened against prompt injection. The fact that a security‑review tool is vulnerable to security attacks is something teams should recognize before adopting it in production.

Related articles: