How Anthropic secures code when Claude writes most of it

Anthropic published a detailed look at how it keeps its own software secure now that most of its code is written by AI. The numbers frame the problem: engineers ship about eight times as much code per quarter as they did a few years ago, and Claude writes roughly 80 percent of what gets merged. Reviewing that volume by hand is not possible, so the security work has moved into the pipeline itself.

At the design stage, Claude Opus reads proposals against an internal knowledge index and the MITRE ATT&CK framework, which lets teams self-approve low-risk launches. During coding, security rules live in CLAUDE.md files, a /security-review command looks for attacker-controllable input and suspicious links, and agents run on virtual machines with a restricted egress allowlist so a prompt injection cannot reach the open internet. Pull requests are checked by several narrow review agents rather than one general one. Anthropic says about 54 percent of PRs get substantive review comments, and estimates that current tooling would have caught a third of the bugs behind past claude.ai incidents. In staging, continuous scanning runs against live builds, and the same approach found more than 500 high-severity vulnerabilities in open-source dependencies in February. Incident-response agents get single-purpose permissions and log every action to the company's SIEM. You can read the full writeup.

Why it matters

If your team is letting agents write most of its code, manual review breaks at that volume. The model here is specific and worth copying: narrow review agents per pull request, egress-locked build machines, and risk tiers that decide how much a human still checks.