Amazon Web Services Inc. today said it has partnered with Anthropic PBC and OpenAI Group PBC to wire AWS Continuum for code vulnerabilities directly into the tools developers write code in.

The integrations cover Anthropic’s Claude Code, OpenAI’s Codex and Kiro, AWS’s own agentic development environment. A developer will be able to trigger a security scan without leaving the editor. Those findings would go back to Continuum, which ranks them against the rest of the customer’s environment before recommending anything.

Chet Kapoor, vice president of search, security and observability at AWS, announced the partnerships in a blog post. Kapoor wrote that frontier models have gotten good enough at spotting flaws that the bottleneck has moved to the machinery around the model. AWS calls its own version of that machinery an agent-team loop, an orchestration layer that picks a model per task and holds the connections into a customer’s accounts.

Continuum reads account configurations, identity and access management policies, network topology and internet exposure before deciding a finding is worth a developer’s attention. A bug in code that never reaches production ranks below one sitting on a public path. The service also builds a working exploit in a sandbox to confirm the vulnerability is real, which is how it culls false positives.

AWS described two ways to use it. On existing code, Continuum works through what is already deployed. On new code, it feeds security-checked suggestions in while the code is still being written.

“AWS Continuum connects source code with enterprise knowledge, allowing teams to accurately pinpoint security vulnerabilities and verify that flagged issues are truly meaningful,” said Mike Johnson, chief information security officer at Rivian Automotive Inc. “This shortens what really matters: timeline to fix serious vulnerabilities.”

Continuum launched at the AWS Summit in New York on June 17. AWS describes it as model agnostic, calling on whichever frontier model performs best at a given stage, and has pointed to Anthropic’s Claude Mythos as an example of a model capable of reasoning through attack paths without being walked there.

Third parties have started building on it. Skyhawk Security Ltd. said in late July that it was feeding Continuum findings into simulated attacks against digital twins of customer cloud environments, ranking flaws by whether an attacker could actually weaponize them.

AWS Continuum for code vulnerabilities remains in gated preview and requires a request for access. The company gave no date for the Claude Code, Codex and Kiro integrations beyond saying they are coming soon.

Photo: AWS