Claude Security Comes to Claude Code: Multi-Agent Vulnerability Scans and Reviewed Patch Suggestions¶

For / Adoption Decision

For: Developers evaluating security audits of existing repositories from Claude Code

Key Points:

The Claude Security plugin runs an on-demand multi-agent deep scan over a repository or diff
security-guidance checks code while Claude writes it, so its scope and trigger are different
Findings and patches receive independent review, but patches are never applied automatically and existing scanners still remain necessary

Anthropic released Claude Security as an official Claude Code plugin in beta on July 22, 2026.¹² From /claude-security, a user can scan a repository or committed changes and turn selected, verified findings into patch candidates.

This is not a lightweight guard that runs after every edit. The question is where the new plugin belongs next to security-guidance and /security-review.

Claude Security maps existing code, models attack paths, searches in parallel, independently checks findings, and stops patch proposals at human approval

The Enterprise Web Capability Has Moved into the CLI¶

The change is an expansion of access and execution location, not the first appearance of Claude Security. Previously called Claude Code Security, it moved from a limited research preview to a public beta for Claude Enterprise on April 30, 2026. The web service scans connected repositories from claude.ai/security or the Claude.ai sidebar and requires an administrator to enable it.³

The new plugin runs inside a Claude Code session. It can reach repositories on GitLab or Bitbucket and code on networks that do not accept inbound connections, where the managed web service cannot connect. Each scan counts against the user's plan limits.²

The product page describes the plugin beta as available to all Claude Code users, while the execution prerequisites require a paid plan.²⁴ The distinction is therefore between an Enterprise managed web service and a plugin for paid Claude Code plans.

security-guidance Is a Continuous Guard; Claude Security Is a Deep Audit¶

Despite their similar names, the two plugins do not duplicate the same job. security-guidance reviews code Claude changes in the current session. Once installed, it runs at three points without a separate command: after edits, at the end of a turn, and when Claude commits or pushes.⁵

The edit-time layer uses regular expressions and string matching without a model call. The end-of-turn and commit reviews use separate Claude contexts and consume additional usage. The plugin is available on all plans, but that does not mean every layer is cost-free.⁵

The Claude Security plugin explicitly targets an existing codebase for a deeper investigation. Multiple agents map the architecture, build a threat model, and hunt for vulnerabilities. Separate verifier agents independently evaluate candidates before they enter the report.²

Dimension	security-guidance	Claude Security plugin
Primary scope	Code Claude changes during a session	Existing repository, branch, PR, or commit
Trigger	Automatic on edit, turn end, and commit	Explicit `/claude-security` run
Depth	Layered early detection	Multi-agent audit with threat modeling
Requirements	All plans, Claude Code v2.1.144+	Paid plan, v2.1.154+, Dynamic Workflows
Usage	Edit check is free of model calls; model reviews add usage	Each scan adds usage

One layer stops routine mistakes early; the other spends more time and usage investigating existing assets.

A Scan Changes the Checkout by Adding Reports, Not Source Edits¶

The plugin requires Claude Code v2.1.154 or later on a paid plan, Python 3.9.6 or later, and Dynamic Workflows. Git is required for change scans and patch generation, although a full scan can run in an unversioned directory.²

Installation takes three steps inside a Claude Code session:

Install with /plugin install claude-security@claude-plugins-official
Load it into the current session with /reload-plugins
Choose the scan scope from /claude-security

Before a run, the plugin reads the target and offers the full repository or focused areas with file counts and relative cost. It waits for explicit confirmation, and Claude Code must remain open while the scan runs.²

Results go into CLAUDE-SECURITY-<timestamp>/. The directory contains a Markdown report, JSONL findings, and a revision stamp recording the scanned commit and verification coverage. Each finding includes an ID, impact, exploit scenario, severity, confidence, and recommendation.²

This results directory is the only checkout change made by a scan; the source code remains untouched. Scans are nondeterministic, so rerunning the same commit can produce different findings. The revision stamp binds a report to an input and effort level, but it does not make the analysis reproducible.

Independent Patch Review Still Stops Before Automatic Application¶

Patch generation adds another safety boundary after finding verification. An agent independent of the patch author reads the diff and existing test results, then checks that the change resolves one finding, introduces no new vulnerability, and leaves other behavior unchanged. If it cannot vouch for all three conditions, the plugin returns an explanation instead of a patch.²

An accepted candidate still lands only as a file such as patches/F1.patch. The plugin never applies it automatically. The user chooses whether to run git apply, and the documentation recommends putting each finding into a separate pull request for isolated review and testing.²

That boundary is more conservative than the phrase “automated remediation” might suggest. Claude Security carries an audit candidate and a reviewed fix proposal to a human approval point; it does not remove that point.

Adoption Depends on the Gap in an Existing Defense Stack¶

The Claude Security plugin does not replace static analysis or dependency scanning. Anthropic places it in a defense-in-depth stack alongside security-guidance, the one-pass /security-review, pull-request Code Review, the managed Claude Security service, and existing CI scanners.²

Stage	Main tool	Best fit
During work	security-guidance	Catch issues in code Claude just wrote
One-off	`/security-review`	Check the current branch once
Deep audit	Claude Security plugin	Audit a repository or diff from a threat model
Pull request	Code Review	Ongoing Team and Enterprise review
Managed	Claude Security web service	Monitor connected repositories on Enterprise
CI	SAST and dependency scanners	Enforce deterministic rules and supply-chain policy

An untrusted repository can also contain hostile instructions or hooks. Claude Code requires trust confirmation on first use, while its official security guidance recommends reviewing commands and critical changes and using a sandbox or VM for untrusted content.⁶⁷

The plugin's practical value is that a developer can add a deep audit from a local Claude Code workflow without an Enterprise managed repository connection. Nondeterminism, usage cost, and human approval remain. The right adoption question is not whether it replaces another scanner, but whether context-dependent vulnerabilities justify additional exploration budget beyond the existing stack.

Claude (@claudeai), Claude Security plugin beta announcement, July 22, 2026. ↩
Claude Code Docs, Scan your codebase for vulnerabilities, accessed July 23, 2026. ↩↩↩↩↩↩↩↩↩↩
Anthropic, Claude Security is now in public beta, April 30, 2026. ↩
Anthropic, Claude Security product page, accessed July 23, 2026. ↩
Claude Code Docs, Catch security issues as Claude writes code, accessed July 23, 2026. ↩↩
Claude Code Docs, Security, accessed July 23, 2026. ↩
Claude Code Docs, Sandboxing, accessed July 23, 2026. ↩