Anthropic Releases Beta Version of Claude Security Plugin for Claude Code – Multi-Agent Vulnerability Scanner for the Terminal

Anthropic has released the beta version of the Claude Security plugin for Claude Code. The plugin adds the /claude-security command, which opens a menu with three tasks: scanning the codebase (entirely or partially), scanning changes (diff of a branch, PR, or individual commit), and generating patches from found vulnerabilities. Installation is done with two commands: /plugin install claude-security@claude-plugins-official and /reload-plugins. The scanning process is implemented as a dynamic workflow in JavaScript consisting of six phases: inventory, threat modeling, investigation (across four categories: injections and input, authentication and access, memory and unsafety, cryptography and secrets), sanitization, panel review, and adversarial check (only at the max level). Candidates for findings are only included in the report after a panel review by three independent verifiers based on the criteria REACHABILITY, IMPACT, and SAFEGUARDS, with a quorum of 2 out of 3. The confidence level for a finding is limited: 3/3 yields up to High, 2/3 yields Medium. Verification results are computed programmatically, not by the model. Each scan creates a CLAUDE-SECURITY-<timestamp> directory with three artifacts: a report in Markdown and JSONL formats, and a revision file. Patches are created in a clone of the repository, independently checked against three conditions, and applied only manually via git apply. The plugin requires a paid plan with Claude Code v2.1.154 or later, Python 3.9.6, Git, and enabled dynamic workflows. Scans are non-deterministic and do not replace traditional SAST, dependency scanning, or code review.