Editorial illustration for Anthropic Beta Tests Claude Security Plugin for Terminal Vulnerability Scanning
Claude Security Plugin Scans Terminal Vulnerabilities
Anthropic Beta Tests Claude Security Plugin for Terminal Vulnerability Scanning
Anthropic pushed a new tool into beta this week called Claude Security, a plugin built for Claude Code that hunts for vulnerabilities without leaving the terminal. Install it from the official Anthropic marketplace with two commands, /plugin install claude-security@claude-plugins-official followed by /reload-plugins, and it adds a single slash command: /claude-security. That command opens a menu with three options: scan an entire codebase, scan a set of changes like a diff or pull request, or take an existing report and generate .patch files for review.
The plugin is public in the claude-plugins-official repository, currently sitting at version 0.10.0. What makes it different from a typical linter or static analyzer is how the scan itself is built. Rather than running as one monolithic process, it's structured as a dynamic workflow, a JavaScript orchestration script that splits the work across multiple subagents working in parallel.
Anthropic designed it to handle two very different use cases: a full audit of a repository, or a quick check of what's about to get committed. The orchestration logic behind that split is where the plugin gets interesting.
Anthropic has released the Claude Security plugin for Claude Code in beta. The plugin runs a multi-agent vulnerability scan of a repository from inside an existing Claude Code session, then turns the findings you select into patch files that you review and apply yourself.
Why this matters
For teams shipping AI-assisted code, the interesting part here isn't the scanning itself, it's the verification stamp. Anthropic built a mechanism that flags when its own multi-agent panel skipped a finding, rather than just presenting a clean report and hoping you trust it. That's a small but real admission that these systems can fail silently, and a rare instance of a vendor building in a way to catch that failure instead of papering over it.
Developers running this in beta should treat the "unverified" flag as the most useful part of the tool, not an edge case to ignore. If Anthropic can extend that pattern, requiring agents to show their work and flag gaps rather than just output a verdict, to other Claude Code plugins, that's a more durable trust model than accuracy claims alone. For now, the plugin only proposes patches you apply yourself, which is the right amount of caution. Worth watching whether that human-in-the-loop step survives contact with teams under deadline pressure, because that's usually where safeguards like this get skipped first.
Related Reading
Browse all Anthropic news →
Open Source Trump cracks down on Anthropic after Amazon tip; staff largely foreign
Open Source SDOF Adds Two Defensive Layers via Intent Router and StateAwareDisp
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Related Topic Anthropic says Claude writes >90% of its code; AI pause button urged
LLMs & Generative AI
Related Topic Claude Mythos highlights EU AI safety gaps, says researcher Caroli
Policy & Regulation
From Archives Treasury threatens sanctions over alleged Anthropic IP theft
From Archives OpenAI: Hugging Face Breach Traced to Pre-Release Models' Testing Goal
From Archives White House Studies Chinese AI Firm's Distilled Anthropic Model
Policy & Regulation
From Archives AMD commits USD 5 billion to Anthropic for AI chip deployment
Research & Benchmarks
Common Questions Answered
How do you install the Claude Security plugin for Claude Code?
You can install the Claude Security plugin by running two commands in your terminal: /plugin install claude-security@claude-plugins-official followed by /reload-plugins. Once installed, the plugin adds a single slash command called /claude-security that opens a menu with scanning options.
What are the three scanning options available in the Claude Security plugin menu?
The Claude Security plugin offers three scanning options: scan an entire codebase for vulnerabilities, scan a set of changes like a diff or pull request, and scan individual files or code snippets. Each option allows developers to choose the scope of vulnerability detection that fits their workflow.
How does the Claude Security plugin's multi-agent vulnerability scan work?
The Claude Security plugin runs a multi-agent vulnerability scan of a repository from within an existing Claude Code session, then converts any findings you select into patch files for your review and application. This approach gives developers control over which vulnerabilities to address rather than automatically applying changes.
What verification mechanism does Anthropic include in the Claude Security plugin to catch failures?
Anthropic built a mechanism that flags when its multi-agent panel skipped a finding rather than presenting only a clean report, acknowledging that these systems can fail silently. This transparency helps developers understand potential gaps in the vulnerability scanning process instead of relying on incomplete results.
Further Reading
- Anthropic's New Security Plugin - SOCFortress
- Claude Security Plugin | Claude by Anthropic - Claude by Anthropic
- Scan your codebase for vulnerabilities - Claude Code Docs - Claude Code Docs
- 「Claude Code」プラグイン「Claude Security」がベータ公開 - Impress Watch
- Anthropic Launches Security-Guidance Plugin for Claude Code to Detect Vulnerabilities in Real-Time - KuCoin News
