Anthropic Put a Security Team of Claude Agents Inside Claude Code. No Finding Reaches You Until a Second Agent Signs Off.

TL;DR

On July 22, Anthropic shipped the Claude Security plugin for Claude Code, in beta. It is not a linter. Run /claude-security and a team of Claude agents maps your repository, builds a threat model, hunts for vulnerabilities across categories like injection, auth, memory safety, and secrets, and then makes a separate agent independently review every finding before a single one lands in the report. You point it at a whole repo or just a branch diff. It writes results to a timestamped folder, drafts fixes as patch files in a scratch copy of your code, and never applies them for you. The one number Anthropic did not publish is a detection rate, so treat the accuracy as unproven until someone benchmarks it.

What actually shipped

The plugin installs from Anthropic's official marketplace with /plugin install claude-security@claude-plugins-official, then /reload-plugins to activate it in the session. It adds exactly one command, /claude-security, which opens a menu with three jobs: scan the whole codebase, scan only a set of changes (a branch's diff, a pull request, or a single commit), or turn findings into patches. You can also skip the menu and just say what you want, such as "scan commit abc1234".

The prerequisites are specific: Claude Code v2.1.154 or later on a paid plan, because the scan uses Claude Code's dynamic workflows to orchestrate its agents, plus python3 3.9.6 or newer on your PATH (the tooling uses only the standard library, so nothing gets installed). It runs locally in your session, and every scan counts against your plan's usage limits. There is no separate product to buy and no code leaving your machine for a hosted scanning service.

A team of agents, not a pattern matcher

The interesting part is the architecture. Traditional static analysis matches your code against a rulebook of known-bad patterns: fast, deterministic, and blind to anything the rules did not anticipate. The Claude Security plugin instead runs a small crew of agents that reason about the code the way a human security researcher would. One pass maps the architecture and traces data flows across files, another builds a threat model of entry points and sensitive sinks, others hunt for bugs by category, and a final set of verifier agents independently re-examines each candidate before it is written down.

That independent-review step is the whole point. Picture a newsroom: a reporter files the story, but a separate fact-checker has to sign off before it prints. Here the agent that finds a bug is not the agent that gets to publish it, which is how Anthropic keeps the report short enough to actually read instead of a wall of maybes. According to MarkTechPost's breakdown, the pipeline runs in phases (inventory, threat modeling, per-category research, a coverage sweep, a multi-lens verification panel, and an optional adversarial pass), with an orchestrator agent on Opus and the mapping agents on Sonnet.

One honest wrinkle: scans are nondeterministic. Two runs over the same code can surface different findings, which is what you would expect from agents reasoning rather than a fixed ruleset, and exactly why the docs tell you to scan regularly and lean on the revision stamps rather than trust one clean run.

Where it sits in the stack

This is the fifth security surface Anthropic has bolted onto Claude Code, and they do not overlap by accident. The security guidance plugin catches issues as Claude writes code. The /security-review command does a single pass over your current branch. Code Review works at pull-request time. And the managed Claude Security product, an Enterprise-plan service, monitors connected repos from Anthropic's side. The new plugin is the on-demand deep-scan layer in the middle.

The plugin's edge over the managed service is reach: because it runs in your session, it can scan repositories the hosted product cannot touch, such as code on GitLab or Bitbucket, or on an air-gapped network that does not allow inbound connections. Anthropic is explicit that none of this replaces your existing static analysis and dependency scanners. It reasons about business logic, those enforce deterministic rules, and you want both.

The report, and the patches you actually apply

Every scan writes a timestamped CLAUDE-SECURITY-<timestamp>/ directory into your repo, with a human-readable CLAUDE-SECURITY-RESULTS.md (each finding gets an ID, impact, exploit scenario, severity, confidence, and a recommendation), the same data as JSONL for tooling, and a revision stamp recording exactly which commit was scanned and how thoroughly it was verified. That directory ships with its own .gitignore so a stray git add never sweeps a vuln report into a commit, a small courtesy that tells you someone who has been burned designed this.

Fixes are handled with matching caution. Ask for patches and each one is drafted in a scratch copy of your repo, then reviewed by an agent independent of the one that wrote it, which runs your tests against the change when the code has them. A patch is only written if that reviewer can vouch that it fixes the one finding, adds no new vulnerability, and changes nothing else. Then it lands as an F1.patch file that you apply yourself with git apply, one per pull request. The one thing it flatly refuses to do is commit for you, which after this year's parade of agents that helpfully deleted someone's home directory is precisely the right amount of paranoia.

Why a builder should care

If you already live in Claude Code, this collapses "get a security review" from a separate tool, a separate login, and a separate export into one command that reads the same repo your agent already has open. For a solo builder or a small team with no application-security hire, an on-demand researcher that traces data flow and writes exploit scenarios in plain language is a real capability that used to cost a retainer. And because findings are verified before they surface and patches are gated behind their own test run, the signal-to-noise ratio is aimed higher than the usual scanner firehose.

Just keep the caveats in view. It is beta, its findings are nondeterministic, and Anthropic has published no detection or false-negative numbers, so it is a strong second pair of eyes, not a compliance checkbox and not a reason to fire your other scanners.

The caveats

• No accuracy numbers. Anthropic did not disclose detection rates, language coverage, or false-negative figures. Treat coverage as unproven until independently benchmarked.
• Nondeterministic by design. Two scans of the same code can return different findings. Run it regularly rather than trusting a single pass.
• It costs tokens. Full-repo scans run a crew of agents and can burn a significant number of tokens against your plan, so scope large repos to one area at a time.
• Beta, and complementary. It does not replace static analysis, dependency scanning, or human review. It is one layer in a defense-in-depth stack.
• A funny edge case. Run it on Fable 5 and Anthropic's own cybersecurity safety classifier can flag the scan's activity and quietly downgrade the model to Opus. The scan still finishes. The security tool just occasionally trips the security guardrail.

Key Takeaways

• Anthropic shipped the Claude Security plugin for Claude Code in beta on July 22, adding one command, /claude-security, that runs a multi-agent vulnerability scan inside your session.
• A separate set of verifier agents independently reviews every finding before it reaches the report, which is the design's main pitch over pattern-matching scanners.
• It scans a full repo or just a diff, writes results to a timestamped folder with severity and exploit scenarios, and drafts patches you review and git apply yourself. It never auto-commits.
• It is the on-demand deep-scan layer alongside the security guidance plugin, /security-review, Code Review, and the managed Enterprise product, and it reaches repos the hosted service cannot.
• Requires Claude Code v2.1.154+, a paid plan, and python3 3.9.6+, and scans count against your usage limits.
• Anthropic published no detection metrics and scans are nondeterministic, so treat it as a strong extra reviewer, not a replacement for your existing scanners.

Sources: Claude Security plugin docs, Claude Security product, MarkTechPost, GBHackers, Cyber Security News