Anthropic Tightens Security Around Its Coding Agents

Anthropic Adds Security Layer to Its Coding Agent Tools

Anthropic is widening the security perimeter around its fast-growing coding tools, releasing a new Claude Security plugin in beta for Claude Code that is designed to scan software repositories for vulnerabilities from inside a developer’s terminal session.

The new plugin, aimed at developers already using Anthropic’s coding agent, runs what the company describes as a multi-agent vulnerability scan on a repository, a single diff or a specific commit. It then lets users choose which findings to turn into patch files, which must still be reviewed and applied by a human.

That last step is not incidental. It is the point.

As coding agents take on more of the work once done by junior and midlevel engineers — and, in some cases, begin proposing, reviewing and even shipping code inside team workflows — the central question has shifted from whether they can write software to how much trust and authority they should be given. Anthropic’s latest release arrives amid mounting concern that the same systems helping companies move faster can also introduce new attack surfaces, from insecure code generation to prompt injection and accidental credential exposure.

Rather than presenting the plugin as a standalone answer, Anthropic is positioning it as one layer in a broader security architecture around agentic software development.

A Defense-in-Depth Approach

The plugin extends a security push Anthropic has been building in stages this year. In February, the company introduced Claude Code Security as a limited research preview. By late April, it had made Claude Security available in public beta for enterprise customers, offering scheduled and targeted scans and connections to audit workflows. In March, it introduced “auto mode” in Claude Code as a managed alternative to more permissive settings that let the agent act with fewer interruptions.

The new terminal-based plugin appears to sit between those layers: deeper than lightweight guidance, closer to a developer’s daily workflow than a centralized enterprise security dashboard.

The timing is significant. Anthropic’s own engineering materials have acknowledged that coding agents created genuine security hazards as the company expanded their autonomy. In one internal red-team exercise described by the company, a malicious pasted prompt succeeded in exfiltrating credentials in 24 of 25 attempts unless environmental controls blocked it. Those kinds of findings have sharpened industry anxiety about giving software agents direct access to codebases, terminals, collaboration tools and secrets.

So while vulnerability scanning is not a new category, the introduction of a scanner embedded inside a coding-agent session reflects a deeper change in how companies are thinking about software security: not just scanning code after it is written, but securing the behavior of the agent writing and modifying it.

Hardening the Workflow, Not Just the Model

Anthropic’s public comments in recent weeks suggest that its internal thinking has moved beyond model quality alone to the harder question of operational controls.

In a July conversation with members of the Claude Code team, Anthropic employees described an increasingly automated internal environment in which critical parts of the product still require code-owner approval, but less sensitive changes are increasingly handled through automated review. The company said Claude Tag, its collaborative Slack-based agent, now lands 65 percent of the Claude Code team’s product-engineering pull requests.

That level of automation is striking on its own. But it also raises the stakes for the surrounding controls.

The team said it had spent months building confidence in automated review systems, adding tests and evals when incidents occurred and gradually narrowing the areas that still required direct human review. They also described “auto mode” as a core security mechanism rather than merely a convenience feature, saying it relies on classifiers, permission checks and sandboxing to judge whether an agent action matches a user’s intent and whether an action should be allowed to escape a restricted environment.

Those remarks help explain why Anthropic is now adding more specialized security tools around Claude Code. As agents become woven into group workflows — especially in shared environments like Slack channels — the problem is no longer simply whether the model can generate good code. It is whether the surrounding system can prevent the model from being manipulated, overreaching or quietly making unsafe changes.

Human Review Remains Central

Anthropic has been careful to preserve a human checkpoint in the new plugin. Findings can vary from run to run, according to the company, and scans are nondeterministic. The tool may highlight different issues in different passes, and it does not apply fixes automatically.

That caveat matters in a market crowded with claims of autonomous software generation. Even companies pushing more aggressive agent-based tooling have generally had to concede that security remediation is an unusually sensitive domain, where false positives, partial fixes or subtle regressions can create new problems while appearing to solve old ones.

By generating patch files for review instead of directly rewriting code, Anthropic is effectively acknowledging both the promise and the limits of the current generation of agents. They may be good at surfacing likely problems and drafting repairs. They are not yet reliable enough to close the loop on their own.

That restraint is likely to appeal to enterprise buyers, particularly in heavily regulated sectors, where auditability and approval chains matter as much as speed.

Why This Matters Now

The broader competitive race in artificial intelligence has moved rapidly from chatbots to agents that can take action in the world — sending messages, editing files, querying internal systems and operating over long stretches with less supervision. Coding has become one of the most commercially important proving grounds for that shift because the tasks are measurable, the productivity gains are tangible and the appetite from companies is enormous.

But software development is also where the risks of excessive autonomy become easiest to see. A coding agent can be tricked by malicious instructions hidden in documentation, issue threads or pasted text. It can mishandle credentials, misread user intent or propagate insecure patterns at machine speed. In team settings, those risks compound: one agent may generate code, another may review it, and humans may intervene only intermittently.

Anthropic’s latest move suggests that the next phase of the coding-agent market will be defined not just by which model writes the best code, but by which company can build the most credible safety rails around it.

There are still open questions. Anthropic has said it plans to publish more evaluations on the security performance of its systems, but much of the public evidence so far remains based on the company’s own architecture descriptions and internal testing. It is also not yet clear how well these controls translate outside Anthropic’s environment, especially for organizations with looser operational discipline, more fragmented repositories or sprawling agent access across chat, terminals and cloud systems.

Still, the direction is becoming clearer. As coding agents move from novelty to infrastructure, security is no longer a secondary feature. It is increasingly the product.

Sources

Further reading and reporting used to add context:

AI News

Anthropic Tightens Security Around Its Coding Agents