Government IT is rarely pretty. Old code, badly documented, grown over decades — and right in the middle of it, the most sensitive data a state holds. The Canadian province of Alberta has now shown how to tackle that problem with AI. And the numbers are striking.
466 Million Lines in 20 Hours
Alberta’s Ministry of Technology and Innovation maintains the systems of 27 provincial ministries — roughly 1,280 applications and 3,400 code repositories. Most of it had never been systematically reviewed for security. The accumulated technical debt runs into the billions.
So an internal team put Claude Code, using Opus and Sonnet models, to work on it. Around 50 agents worked in parallel and autonomously, scanning the entire codebase for vulnerabilities, infrastructure weaknesses, and documentation gaps. The result: 466 million lines of code reviewed in about 20 hours. The team estimates a traditional approach would have taken around 6.5 years.
The trick was a two-stage routine. First, a rules engine flags known patterns. Then Claude reviews each hit and cites the exact file and line — so developers can verify it. That’s precisely where a lot of automated scanners fall down: they produce noise. Here, you got traceable findings.
Not Just Finding — Fixing
The interesting part is step two. Where the scan found a hole, Claude Code could often generate a fix, test it, and build it directly. Where the tests needed to confirm a patch were missing, Claude wrote them first. And where code was too old or too tangled to patch, it was rebuilt in a more modern language.
One example that sticks: a portal for a subsidy program, originally hand-coded in Java about 25 years ago. The first version took five months. The rebuild with Claude: four to five days. Before every deploy, a human team reviewed and approved the change — the human stays in the loop.
Red and Blue Agents
Alberta also built specialized review agents that run continuously. A “red team” agent attacks the application from the outside, the way an attacker would. A “blue team” agent assesses the defenses against an international security standard and writes a remediation plan pointing to specific files. Every application is checked against roughly 95 security controls per pass. The whole thing runs on the Claude Agent SDK.
My Take
What convinces me here isn’t raw speed — it’s the combination of speed and traceability. File, line, fix, test, human sign-off. This isn’t “AI now does everything alone.” It’s a tool doing a job that was simply unaffordable before. No government on earth can realistically spend 6.5 years on this. Twenty hours, though — that they can do.
Alberta published its experience as technical white papers so other governments can learn from it. That’s exactly how this should work.
Sources: