Claude Security can now mark a vulnerability fixed even when developers repair it outside Anthropic’s tool, then reopen the finding if it discovers the issue again. The update extends the product’s role from finding problems to keeping findings aligned with changing code.
Anthropic announced the update on October 21, 2026. Available in public beta for Claude Enterprise customers, it adds continuous scanning, project-level threat models, an API and an MCP connector.
Teams may have less manual reconciliation to do between a scanner’s backlog and developers’ work. Whether the system reliably detects vulnerabilities and verifies repairs remains a separate question.
Continuous Scanning Has No Fixed Schedule
Teams start by creating a project, connecting repositories and choosing each repository’s branch and scope. Claude runs a deep baseline scan, then scans changes regularly according to their risk and complexity.
The Claude Security documentation says the first scan can take minutes or hours, depending on repository size. Follow-up scanning has no fixed schedule. “Continuous” describes ongoing monitoring; it does not guarantee that every commit receives an immediate security assessment.
Alongside those scans, Claude checks open findings against changed code and marks them fixed when the relevant repair lands, including work completed through another development process. Findings reopen if Claude detects the issue again.
That could reduce stale tickets and manual status updates. Automatic closure still records Claude’s assessment of the changed code, without establishing that every exploit path has been removed.
Repository Scope Shapes What Claude Can Find
A project can contain up to eight repositories. Anthropic says Claude traces data flows across files and repositories, allowing it to identify problems spanning services, such as a backend trusting input that a client was expected to validate.
Repository grouping therefore becomes part of the security assessment. A project containing only one component may lack code needed to evaluate an interaction across services. Teams should choose scope around relevant dependencies, without assuming separate repository scans provide equivalent coverage.
Code also leaves out deployment facts. Each project has a knowledge base for environmental context, and Claude generates a threat model that teams can review and edit. Subsequent scans use that context to determine what to flag and how severely to rate it.
