Anthropic has rebuilt how Claude Security watches your code. The tool now monitors connected repositories continuously and rescans automatically whenever something changes.
What changed in Claude Security
The company announced the update on October 21, 2026. The core change is continuous monitoring, triggered by new commits rather than a calendar.
When a team first connects a repository, Claude Security runs a deep baseline scan. After that, it switches to lighter scans focused on each new commit. No manual scheduling is required.
The update also changes how individual findings are handled. Each vulnerability is tracked on its own until it is marked resolved.
When Claude Security detects the code change that fixes a flaw, it marks that finding as fixed automatically. If the same issue resurfaces later, the system can reopen it.
Projects can include up to eight repositories from platforms such as GitHub and GitLab. Findings can also flow into external tools through API and MCP connectivity.
MCP, or Model Context Protocol, is a standard for linking AI systems to outside software.
Anthropic positioned the changes as a response to user feedback. The stated goal is coverage that stays current and fits into workflows teams already use.
Who gets access, and what it costs
The feature is available in public beta for Claude Enterprise customers. Eligible organizations can receive up to $25,000 in monthly usage credits for two months, with the offer running until December 31, 2026.
Claude Security draws on the full Claude model family, including Claude Mythos. Customers do not need to join Anthropic’s separate Cyber Verification Program to use it.
Alongside the main product, Anthropic is running a parallel beta plugin for Claude Code. It lets developers run local, session-specific scans on particular repositories or individual changes.
The track record so far
Claude Security entered public beta in April 2026. Since then, thousands of organizations have used it, and together they have identified over one million vulnerabilities.
Anthropic has also been pointing its models at open-source code. The company recently introduced an opt-in OSS Scanner for open-source projects.
Through that effort, Anthropic addressed vulnerabilities across 25 open-source projects, surfacing a total of 493 issues.
What this means for security teams
The most practical shift is timing. Point-in-time scans leave gaps between runs, and code ships during those gaps. Scanning on every commit narrows that window.
Automatic resolution tracking could also cut down on busywork. Letting the tool confirm fixes against the code itself removes some of that manual checking.
The reopening feature addresses regression. A fix that quietly gets undone is arguably worse than a known open bug, because nobody is watching for it.
The eight-repository limit per project may also shape how larger companies organize their rollout. Firms with sprawling codebases could need multiple projects to get full coverage.
The API and MCP integrations may prove decisive for adoption. Security tools that force teams into new workflows tend to get ignored. Tools that push findings into existing systems have a better shot at sticking.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.