Shares of several major cybersecurity providers dropped today after Anthropic PBC introduced a tool for finding software vulnerabilities.

The offering is called Claude Code Security. It’s available as a limited research preview in the Enterprise and Teams editions of Anthropic’s Claude artificial intelligence service. Additionally, the company plans to provide “expedited access” for open-source project maintainers.

Software teams scan their code for vulnerabilities using so-called static analysis tools. Such programs are usually built around a database of rules, or definitions of common cybersecurity vulnerabilities. A static analysis tool works by checking each single snippet of code in an application against its rules.

Static vulnerability definitions can’t cover every single variation of every single exploit. For example, one of a static analysis tool’s rules might not support a niche programming language that a developer used to implement an interface module. As a result, rule-based static analysis tools often miss certain cybersecurity issues. 

Anthropic positions Claude Code Security as a more effective alternative. According to the company, the tool doesn’t use static rules but instead “reasons about your code the way a human security researcher would.” It maps out how an application’s components interact with one another and the way data moves through them to find potential weak points.

Developers can activate Claude Code Security by connecting it to a GitHub repository and asking it to scan the code inside. According to Anthropic, the tool can uncover a wide range of vulnerabilities.

Applications include filters that block malicious user input such as unauthorized SQL commands. Claude Code Security can find code snippets that lack an effective input filter. It also spots more sophisticated issues, such as vulnerabilities that make it possible to bypass an application’s authentication mechanism.

Claude Code Security ranks the security flaws that it finds based on severity. Additionally, it generates a natural language explanation of each one to expedite analysis. A “suggest fix” button below the explainer enables cybersecurity professionals to have Claude generate a patch. 

CrowdStrike Holdings Inc. closed the trading session down almost 8%, while Cloudflare Inc. declined a little over 8%. Several other cybersecurity companies also logged share price declines. The selloff is the second that Anthropic has set off in the enterprise software ecosystem since the start of the month. The previous one was sparked by the company’s launch of Claude Cowork plugins.

Claude Code Security is rolling out about four months after OpenAI Group PBC introduced a cybersecurity automation tool of its own. Aardvark offers many of the same capabilities as Anthropic’s new tool. According to OpenAI, it tests vulnerabilities in an isolated sandbox to estimate how difficult it would be for hackers to exploit them.

There are several ways OpenAI and Anthropic could expand their cybersecurity services over time.

Enterprise software teams use systems called CI/CD, or continuous integration and continuous delivery, pipelines to roll out software updates. The two AI providers could integrate their cybersecurity tools with popular CI/CD products to automatically block updates that contain vulnerable code. Many established cybersecurity companies already offer such a capability.

Image: Anthropic