InfoSecBulletin Cybersecurity for mankind
Anthropic launched the Claude Security plugin in beta. This tool uses AI to find serious security flaws in Claude Code. Developers can use it to spot issues before they release their work.
The tool allows teams to check recent changes or whole repositories from the terminal, using the same Claude inference they already use.
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
The Claude Security plugin operates within Claude Code, Anthropic’s AI tool for coding and git tasks. Developers can check uncommitted changes before committing or do a complete code analysis without interrupting their work.
Admins turn on the feature in the admin console, and setup is easy with a simple guide. The plugin is in beta for all Claude Code users. This method keeps security checks in the daily development process instead of needing separate scanners.
Claude Security has a system with many agents. It starts by mapping the code structure. Then, it finds possible threats. It checks the results to reduce false alarms. Finally, it recommends fixes that match the style.
Humans always check and make every change because the tool does not automatically save them. Early users like the easy workflow and the check that helps trust the results. Scanning the whole repo can raise token costs and may lead to using pricier models, so teams might choose smaller or step-by-step scans.
The system thinks like a security expert. It looks at Git history, tracks data across files, and knows business logic that is more complex than just matching patterns.
Issues Claude Security Plugin Targets
Claude Security focuses on serious vulnerabilities that traditional tools often miss, including:
Memory corruption
Injection flaws
Authentication bypasses
Complex logic errors
It does very well with issues that depend on context and involve many files, where knowing how parts work together is important. Severity levels and confidence scores assist security teams in focusing on the most important things.
Rule-based tools find known patterns but often miss many real problems and have trouble with new or complex bugs. Claude Security looks at code as a whole, providing actual fixes that fit the project’s style instead of just sending out general warnings.
Findings can go into current workflows using webhooks for Slack, Jira, or other ticket systems. Teams can also save results as CSV or Markdown for audits. Recorded dismissals remain for future reference, so triage decisions are clear across tools. Users can restrict scans to one directory or set up scheduled scans for ongoing coverage without needing to start them manually. This helps with fast pre-commit checks and keeps repositories clean. The plugin works with, not instead of, existing security systems, sending results to the tools teams already use.
The Claude Security plugin is now available in beta for all Claude Code users. Admins can activate it in the admin console at claude.ai/admin-settings/claude-code.
Open-source maintainers and business teams get extra protection from increasing smart, AI-driven attacks. Anthropic wants to make code safer by adding top-level research analysis in the terminal. Developers who already rely on Claude Code can start scanning today and keep vulnerabilities out of production with far less friction than legacy tools require.
