2 min read AI-generated

AWS Brings Continuum Into Claude Code — Security Scans Right in the Editor

Copy article as Markdown

AWS is wiring its vulnerability scanner Continuum straight into Claude Code, Codex and Kiro. Developers trigger a scan without leaving the editor — and Continuum ranks findings by whether they are actually exploitable in real context.

Featured image for "AWS Brings Continuum Into Claude Code — Security Scans Right in the Editor"

On August 5, AWS announced a partnership with Anthropic and OpenAI: its in-house vulnerability scanner, “Continuum,” is being wired directly into the tools developers write code in. Specifically, that means Claude Code, OpenAI’s Codex and Kiro, AWS’s own agentic IDE.

What it means day to day

Instead of leaving the editor, you trigger the security scan straight from your environment. The findings flow back to Continuum — and that is where the clever part happens: Continuum scores every vulnerability in the context of your whole environment. It reads account configuration, IAM policies, network topology and the question of what is even reachable from the internet. A bug in code that never ships to production ranks near the bottom. A bug sitting on a public path ranks at the top.

There is one more thing Continuum does: it builds a working exploit in a sandbox to confirm the flaw is real. That is how it culls false positives — the perennial headache of every security scanner.

There are two modes. On existing code, Continuum works through what is already deployed. On new code, security-checked suggestions get fed in while you write. Mike Johnson, CISO at Rivian, sums up the value: it shortens what really matters — the time to fix a serious vulnerability.

The context

Continuum launched in June at the AWS Summit in New York. AWS describes it as model-agnostic: it calls on whichever frontier model performs best at a given stage — and points to Anthropic’s Claude Mythos as an example of a model that can reason through attack paths without being walked there. The underlying argument: the models are now good enough at spotting flaws. The bottleneck is the machinery around them.

One catch: the code-vulnerability scanner is still in a gated preview and requires a request for access. And for the Claude Code, Codex and Kiro integrations, there is no date yet beyond “coming soon.”

My take

I like the core idea: the model is not the problem — everything around it is. Prioritization, context, false positives. That is exactly where Continuum aims. And seeing Claude Code sit alongside Codex and AWS’s own IDE says something: Claude Code is increasingly a serious enterprise surface, not just a toy for enthusiastic solo developers.

Still — “coming soon” and “gated preview” means wait and see for now. Once I can actually trigger the scan inside Claude Code, I will take a look at how good the prioritization really is.


Sources: