There’s no shortage of security tools — most of them match known patterns and hand you a long list where half the entries are false alarms. Anthropic takes a different route. As of this week, the Claude Security plugin for Claude Code is in beta, and it does something classic scanners can’t: it actually reads the code.
One command, three jobs
You install it with two lines from the official Anthropic marketplace:
/plugin install claude-security@claude-plugins-official
/reload-pluginsThat gives you a new command — /claude-security — with a menu of three jobs: scan the whole repository, scan just the diff of a branch or commit, or turn findings into ready-made patch files. Everything runs locally inside your session, and your code never leaves the machine.
Why this is different
Instead of pattern-matching, Claude tries to understand how the components interact. The scan is built as a multi-stage workflow that fans work out across many subagents: first the repo is split into components, then one agent per component models the threats — entry points, sinks, trust boundaries. Researchers then work through four fixed categories: injection, auth and access, memory safety, and crypto/secrets.
The clever part comes next. A finding doesn’t reach the report just because an agent spotted it. Every candidate has to pass a panel of three independent verifiers — one each for reachability, impact, and existing defenses. Two of three must vote ‘true positive’, or the finding is dropped. And the confidence rating is capped: only a unanimous vote earns ‘high’.
One more detail I like: the tally isn’t done by the model itself but by a Python renderer. The report gets a stamp proving the panel actually ran for every finding. That’s rigor you can check, rather than rigor you have to trust.
Patches that earn their place
For fixes, the plugin clones the repo into a scratch folder — your working tree is never touched. A second, independent agent reviews the patch and runs the project’s own test suite. A patch file only gets written if that agent can guarantee three things: it fixes exactly this finding, it introduces no new hole, and it changes nothing else about the behavior. Nothing is applied automatically — you do that yourself with git apply.
My take
This lands in a week when half the industry is debating kill switches and guardrails. While OpenAI’s models are breaking out of sandboxes, Anthropic ships a tool that helps the defenders — and does it with a rare kind of honesty: the plugin plainly states that it adds no isolation of its own, is nondeterministic, and doesn’t replace traditional scanners. No silver bullet, then, but an extra layer of review with built-in distrust of its own results. That’s exactly what AI security should look like. It needs a paid plan with Claude Code v2.1.154 or later and dynamic workflows enabled.
Sources: