On August 5, AWS announced a partnership with Anthropic and OpenAI: its in-house vulnerability scanner, “Continuum,” is being wired directly into the tools developers write code in. Specifically, that means Claude Code, OpenAI’s Codex and Kiro, AWS’s own agentic IDE.
What it means day to day
Instead of leaving the editor, you trigger the security scan straight from your environment. The findings flow back to Continuum — and that is where the clever part happens: Continuum scores every vulnerability in the context of your whole environment. It reads account configuration, IAM policies, network topology and the question of what is even reachable from the internet. A bug in code that never ships to production ranks near the bottom. A bug sitting on a public path ranks at the top.
There is one more thing Continuum does: it builds a working exploit in a sandbox to confirm the flaw is real. That is how it culls false positives — the perennial headache of every security scanner.
There are two modes. On existing code, Continuum works through what is already deployed. On new code, security-checked suggestions get fed in while you write. Mike Johnson, CISO at Rivian, sums up the value: it shortens what really matters — the time to fix a serious vulnerability.
The context
Continuum launched in June at the AWS Summit in New York. AWS describes it as model-agnostic: it calls on whichever frontier model performs best at a given stage — and points to Anthropic’s Claude Mythos as an example of a model that can reason through attack paths without being walked there. The underlying argument: the models are now good enough at spotting flaws. The bottleneck is the machinery around them.
One catch: the code-vulnerability scanner is still in a gated preview and requires a request for access. And for the Claude Code, Codex and Kiro integrations, there is no date yet beyond “coming soon.”
My take
I like the core idea: the model is not the problem — everything around it is. Prioritization, context, false positives. That is exactly where Continuum aims. And seeing Claude Code sit alongside Codex and AWS’s own IDE says something: Claude Code is increasingly a serious enterprise surface, not just a toy for enthusiastic solo developers.
Still — “coming soon” and “gated preview” means wait and see for now. Once I can actually trigger the scan inside Claude Code, I will take a look at how good the prioritization really is.
Sources: