Anthropic brought its Claude Security vulnerability scanner directly into the Claude Code terminal on July 22, 2026, releasing it as a public-beta plugin for every Claude Code user. The original Claude Security product ran from the claude.ai sidebar for enterprise teams. The new plugin runs a multi-agent scan of your repository from inside an existing coding session, then turns the findings you select into patch files you review and apply yourself.
Try it: scan a repo before you commit
Install it from the official marketplace with the terminal command /plugin install claude-security@claude-plugins-official, then run /reload-plugins to activate it without restarting. The plugin adds a /claude-security command that opens three choices: scan the full codebase, scan just your recent changes, or suggest patches for what it found. Nothing applies automatically, so you review each proposed patch and run git apply yourself. MarkTechPost's write-up walks through the menu in detail.
Why it matters
Coding agents write code fast, and speed is exactly how injection flaws, authentication bypasses, and memory-safety bugs slip in. Claude Security, which Anthropic first launched as an enterprise product in April, reads across files and traces data flows like a security researcher rather than pattern-matching, and it runs the review as a separate agent with a fresh context so the model that wrote the code is not grading its own work. A multi-stage validation pass independently checks findings to keep false positives down. It pairs well with the permission discipline we wrote about after a coding agent deleted files without asking.
Key details
The scanner focuses on four categories: injection and input, auth and access, memory and unsafe operations, and crypto and secrets. It runs on Claude Opus 4.7 by default and is available on all plans during the beta. Anthropic also ships a passive companion, the security-guidance plugin, which reviews code as Claude writes it at three points: each file edit, the end of each turn, and each commit. Setup for both lives in the Claude Code security docs, and the deep-scan product has its own reference page.
What to do next
Install the plugin, run /claude-security on a branch you are about to ship, and treat the output as one layer rather than a full audit. Keep your existing static analysis and peer review in place, and if you run Claude Code across a team, review Anthropic's own code migration playbook for how to roll agent tooling out safely. Validate a few findings by hand before you trust the patches on anything sensitive.
