Claude Security moves to continuous scanning in Enterprise beta: auto re-scans as code changes, tracks fixes, editable threat models, plus API and MCP; Anthropic says users found 1M+ vulnerabilities since April

Why it matters

【Key points】

Anthropic upgraded Claude Security on Oct 21 from on-demand scans to continuous monitoring, in public beta for Claude Enterprise.

1. Scale: since its April beta, thousands of organizations found 1M+ vulnerabilities. It runs on the full model family, including Claude Mythos, with no Cyber Verification Program access needed.

2. Continuous scans: after a deep baseline scan, changes are re-scanned based on risk and complexity. Projects can span several repos (GitHub, GHES, GitLab via token) to catch cross-service bugs.

3. Fix tracking: findings close automatically when a fix lands anywhere, and reopen if the issue returns.

4. Editable threat models and a project knowledge base guide severity; findings include attack paths.

5. New API, webhooks, MCP connector and RBAC. Up to $25K/month in free credits for two months, through Dec 31.

【Verifiable】

https://claude.com/resources/articles/claude-security-now-scans-continuously-and-tracks-fixes

https://support.claude.com/en/articles/14661296-use-claude-security

https://x.com/claudeai/status/2112962248218148878

【Our read】

1. Background: this week proved AI can find serious bugs (OpenAI's PHP2Shell, Anthropic's 493 issues). The bottleneck is now follow-through, and this moves from one-off audits to continuous operations.

2. Comparison: OpenAI's Aardvark and DeepMind's CodeMender pair agents with patches; GitHub embeds Copilot Autofix. Claude Security stands out on cross-repo projects, editable threat models and automatic fix status — closer to replacing SAST plus pen tests.

3. Impact: big credits aim to drive Enterprise seats and usage. Anthropic admits scans are stochastic, which clashes with audit reproducibility.

4. Caveat: the 1M figure lacks severity or false-positive data.