Anthropic Expands Claude Security With Continuous Scanning
4 min read
Anthropic expanded Claude Security on October 21, 2026, with continuous repository scanning, automatic fix tracking, and new integration options through an API and Model Context Protocol (MCP) connector, now available in public beta for Claude Enterprise customers. The updated service monitors repositories as code changes, tracks which findings get fixed, and uses team-provided context to determine which vulnerabilities matter most. Since Claude Security entered public beta in April, thousands of organizations have used it to find over a million vulnerabilities.
Continuous Monitoring Replaces One-Time Scans
The October 21 update introduced a new workflow: a project runs one deep baseline scan, then keeps rescanning as commits land. Claude Security checks changed code, marks findings fixed when repairs land, regardless of where they were made, and reopens issues if they recur. This shift transforms the tool from a point-in-time audit into an ongoing monitoring system that adapts to the pace of modern development workflows.
A project can hold several repositories, so Claude can catch issues that live between services. The system evaluates code changes based on their risk and complexity, prioritizing scans accordingly rather than treating every commit equally.
API, Webhooks, and MCP Integration
A new API connects Claude Security to existing workflows, allowing teams to manage projects and repositories, view findings, and resolve or reopen issues. Users can create a personal access token in Claude Security settings, and it can only see and change what the user can. Webhooks can also notify your systems when a new finding lands.
Claude Security is also available as an MCP connector in Claude.ai and Claude Code. An engineer can pull up a finding, ask Claude about it, start the fix, and mark it resolved in the same session. These integrations are designed to reduce context switching and keep security workflows inside the tools developers already use.
Threat Models and Context-Aware Scanning
Teams can provide deployment context and edit generated threat models, shaping severity and helping filter risks already handled by the environment. Each project receives an automatically generated threat model that teams can refine to match their specific security posture and deployment characteristics.
Every finding gets a severity judged against the threat model and an explanation of how an attacker could reach the code, sometimes with an attack-path diagram. Anthropic says every finding goes through multi-stage verification before it surfaces.
Access Controls and Rollout Features
New access controls help admins roll it out across teams. There is an API with personal access tokens, an MCP connector in Claude.ai and Claude Code, webhooks for new findings, and RBAC with Full, Triage and View project roles. These role-based controls allow organizations to grant different levels of access depending on whether team members need to view findings, triage issues, or manage entire projects.
Powered by Claude Mythos
The service scans codebases for vulnerabilities and suggests patches for review. It is powered by the company’s full family of models, including Claude Mythos, without requiring Cyber Verification Program access. Scans run on Claude Mythos, with no Cyber Verification Program access required. Users get findings without direct model access.
Pricing and Availability
It is a public beta for Claude Enterprise, billed at direct token cost. It is a public beta for Claude Enterprise, billed at direct token cost, with up to $25,000 a month in free credits for two months through December 31, 2026. The free credit offer provides organizations time to evaluate the tool’s impact before committing to ongoing costs.
Customer Feedback
Gusto’s product security team highlighted the operational benefits of the update. “Now it keeps up as our code changes, and our team fixes issues right in Claude instead of switching to another tool,” said Jake Meredith, Product Security, Gusto.
Key Facts
- Release date: October 21, 2026
- Availability: Public beta for Claude Enterprise customers
- Vulnerabilities found: Over 1 million since April 2026 public beta launch
- Integration options: API, webhooks, MCP connector for Claude.ai and Claude Code
- Access controls: Role-based permissions (Full, Triage, View)
- Pricing: Direct token cost with up to $25,000/month free credits through December 31, 2026
- Model: Powered by Claude Mythos, no Cyber Verification Program access required
Sources
- Claude Security now scans continuously and tracks fixes – Anthropic
- Claude Security can now spot vulnerabilities that reappear in code – Help Net Security
- Claude Security Continuous Scanning: Fix Tracking, API and MCP – Developers Digest
- Claude Security Now Scans Continuously: What Changed – CellCog AI
Sources
- Claude Security now scans continuously and tracks fixes
- Claude Updates by Anthropic – October 2026 – Releasebot
- Claude Security Continuous Scanning: Fix Tracking, API and MCP
- Anthropic adds continuous code scanning and fix tracking to Claude Security
- Claude Security Now Scans Continuously: What Changed
- Claude Security can now spot vulnerabilities that reappear in code – Help Net Security
