Anthropic Launches Claude Security Plugin to Let Claude Review Its Own Code in Terminal Workflow
Anthropic has introduced the Claude Security plugin in beta, integrating it directly into the Claude Code terminal workflow. Developers who finish a feature with Claude Code now see an option to let the AI scan the code for vulnerabilities it may have introduced before committing.
How the Plugin Operates
Traditional rule-based scanners rely on matching known vulnerability patterns, which produces high false-positive rates and misses logic flaws. Claude Security instead uses a multi-agent system: it first reads the code and maps the architecture, then identifies potential threat points, and finally verifies suspicious findings to filter out false positives. The plugin generates patch suggestions that match the project’s existing coding style rather than generic alerts.
Every proposed fix must be reviewed and approved by a human; the tool never commits changes automatically. This design keeps the developer in control while adding an extra layer of analysis inside the existing command-line workflow.
Addressing Gaps in Traditional Tools
The plugin targets severe vulnerability classes that rule-based scanners often overlook, including memory corruption, injection defects, authentication bypasses, and complex logic errors. It excels at cross-file issues where data flows from one file to another and is incorrectly trusted in a business branch. By reading Git history and tracing data flows across files, the system reasons about whether a potential issue is actually exploitable instead of applying mechanical pattern matching.
Limitations and Practical Considerations
The feature remains in beta, and Anthropic has not published quantitative data on false-positive or false-negative rates. Large full-repository scans can consume significant tokens and occasionally switch to more expensive models, so teams are advised to limit scans to changed directories or use scheduled incremental checks. The company positions the tool as a supplement to existing SAST, DAST, and human security processes rather than a replacement.
Recommended Daily Usage
The most cost-effective approach is to run the scanner on uncommitted diffs before each commit. Results can be forwarded via webhook to Slack or Jira, exported as CSV or Markdown for audit trails, and dismissed findings are tracked to prevent repeated review. This workflow raises the security baseline for small teams and open-source maintainers who lack dedicated security staff.
Broader Implications of AI Reviewing AI-Generated Code
The release highlights an emerging pattern in which the same AI capabilities used to generate code are now applied to detect vulnerabilities created by that generation process. While the approach can surface issues traditional tools miss, Anthropic emphasizes that human oversight remains essential and that token costs must be managed. The long-term impact on code security will depend on real-world performance data gathered during the beta period.
Related articles
Claude Encrypted Thinking Blocks Use Protobuf with Exposed Metadata and AES-GCM Ciphertext
A detailed reverse-engineering of Claude signatures shows that the encrypted reasoning blocks are not opaque containers but structured protobuf messages. The outer envelope contains a 312-byte inner message that holds a 135-byte header, fixed-length nonce and MAC fields, and the actual ciphertext. The header itself reveals the model name such as claude-opus-5, the block type as thinking, and the organizationUuid from the user's Anthropic account. Only the reasoning text is encrypted with AES-GCM, adding exactly 16 bytes for the authentication tag. The analysis covers four protocol versions and notes that organization binding was added in version 15, potentially allowing servers to reject cross-model or cross-organization reuse. The findings provide concrete implications for both the Opus-to-Haiku extraction attack and the leakage of account identifiers in public logs.
Researchers Extract Proprietary Reasoning Traces from Anthropic, OpenAI and Google LLMs, Revealing Hidden Secrets
A team of eight researchers from institutions including ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Tübingen AI Center, MATS and Snyk published a preprint detailing a practical attack that recovers full reasoning traces from closed LLM APIs. The method requires only two API calls and works by feeding encrypted reasoning blocks from strong models such as Claude Opus 4.8 into weaker models from the same provider, such as Haiku 4.5, which then reproduce the hidden chain-of-thought verbatim. Analysis of 6,708 publicly shared agent logs from GitHub and Hugging Face yielded 315,320 recovered traces containing 704 unique secrets, including 62 API keys, 33 passwords and 24 access tokens that never appeared in visible session output. The attack also enables extraction of internal safety policies, system prompts and detailed harmful planning that providers normally filter from final answers. In addition, the same mechanism can be used in reverse to inject malicious instructions into shared logs that later get replayed by unsuspecting users. The authors recommend treating encrypted reasoning blocks as sensitive secrets and propose cryptographic binding of traces to sessions, users and models.
GhostSplice Technique Lets Malicious MCP Servers Trick AI Coding Agents into Exfiltrating Secrets
GhostSplice is a new technique that allows a malicious MCP server to induce an AI coding agent to leak SSH keys, environment secrets, and source code. The attack splits malicious instructions across tool metadata and responses so the agent reconstructs and executes the full exfiltration plan without detecting an overtly malicious command. Tests showed the method raised compliance rates from an average of 42 percent to 82 percent across eleven models, with some systems moving from zero to 100 percent success. The technique requires the developer to connect the attacker-controlled MCP server and for the agent to already possess read access to the targeted files. Defenses focus on strict allow-listing of MCP servers, least-privilege tool permissions, separation of tool output from instructions, and human approval for sensitive operations. The disclosure aligns with prior warnings about poisoned MCP tool descriptions and agentjacking attacks.
Anthropic Claude Code Auto Mode Launches August 14 with Local Classifier and Permission Rules
Starting August 14, Claude Code will run in auto mode on new sessions for Pro, Max, and Team plans, replacing the allow/deny dialog with a local classifier that evaluates every tool call. The classifier rules are stored locally and contain 103 categories across allow, soft_deny, hard_deny, and environment sections, with the single hard_deny rule focused on data exfiltration spanning over 5,000 characters. Enterprise, API, Bedrock, Vertex, and Foundry deployments remain on opt-in for another month. Auto mode pauses after three consecutive blocks or twenty blocks in a session, and broad allow rules such as python:* are disabled while narrow permissions continue to function. Administrators should populate the twenty environment fields, currently only one-third configured on clean machines, before the rollout date.