Anthropic 发布 Claude Security 插件 Beta 版：面向 Claude Code 的多智能体漏洞扫描器

Anthropic 已经发布了 Claude Code 的 Claude Security 插件测试版。该插件可以在现有的 Claude Code 会话中对仓库进行多代理漏洞扫描，然后将您选择的发现转化为补丁文件，由您自己审核和应用。Anthropic 在发布时强调了该工具的多功能性，强调其能够对整个代码库进行全面扫描，也可以在提交之前从终端检查更改。

根据官方文档：https://code.claude.com/docs/en/claude-security，该插件增加了一个命令 /claude-security，它会打开一个包含三个任务的菜单：

安装只需从官方 Anthropic 市场执行两个命令：https://code.claude.com/docs/en/discover-plugins#official-anthropic-marketplace：

如果未找到市场，先运行 /plugin marketplace add anthropics/claude-plugins-official。插件源代码在 claude-plugins-official 仓库中公开：https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security，目前版本为 0.10.0。

扫描作为动态工作流实现：https://code.claude.com/docs/en/workflows — 一个 JavaScript 编排脚本，将工作分配给子代理。脚本声明了六个阶段：

Research 针对四个固定类别进行：injection-and-input、auth-and-access、memory-and-unsafe 和 crypto-and-secrets。对于完全用安全内存语言编写的组件，会去掉 memory-and-unsafe 视角，因此纯 Python 或 TypeScript 组件只有三个视角，而不是四个。

一次运行的操作规模由四个不同的努力等级决定：低、中、高和最大。根据所选择的等级，会实施特定阈值：低和中等级的组件数量上限为12，高和最大等级扩大到24；矩阵单元分配1名研究员，高和最大等级增加到2名研究员；空白填充扫描的次数从低等级的0次，增加到中等级的1次，高和最大等级为2次。当处理范围有限或差异较小时，该过程会压缩为单研究员配置，而不是部署整个矩阵。这确保评估严格与目标比例一致，同时保持相同的验证标准。

系统采用模型分层代理：协调器运行在Opus上，而仓库制图器和只读代码浏览器运行在Sonnet上。此外，研究员和验证员继承会话模型，扫描代理被限制为仅使用只读工具。

这是值得密切理解的部分。候选发现并不是因为研究员发现它就会进入报告。它只有在经过小组审核后才会被纳入报告。

每个候选结果会交给三个独立的验证者，每人一个视角：可达性（REACHABILITY）、影响（IMPACT）和防御（DEFENSES）。每个验证者返回一个结构化裁决：真正阳性（TRUE_POSITIVE）或假阳性（FALSE_POSITIVE），并提供一到两行标明决定性文件及行号。保留法定人数为3人中2人。如果少于三名投票者返回结果，该候选结果将完全不可保留。

小组结果还限制了发现声明的置信度。全体一致的3/3小组允许最高置信度为高；2/3法定人数将其限制为中等级。发现的置信度不能超过其验证所得。

关键是，统计由报告渲染器用Python计算，而不是由产生发现的模型断言。修订印记的verification.status仅在投票记录证明小组对报告中的每个发现都进行了审核时，才设置为verified；否则，将标为unverified并说明原因。这使得报告自身对其严格性陈述成为可以检查的内容，而不是盲目信任的内容。

每次扫描都会在仓库中写入一个带时间戳的CLAUDE-SECURITY-/目录，其中包含三种工件：

该目录是扫描对你的检出所做的唯一更改，并且它自带 .gitignore，因此不会有多余的 git add 将报告包含到提交中。删除那个 .gitignore 可以让你提交报告以进行审计记录。

修复任务会在仓库的临时克隆中开发每个补丁，因此你的工作树和索引不会受到影响。一个独立于编写补丁的代理会审查暂存的差异并运行项目自带的测试套件来验证更改。

只有当验证者能够自信地确认以下三点时才会生成补丁文件：更改解决了特定问题，没有引入新的漏洞，并且行为未发生其他变化——其中代码接受的输入发生更改也算作行为变化。任何在声称修复问题的同时削弱安全性的更改，比如放宽认证检查或禁用测试，都会被自动拒绝。如果验证者不能保证这三点，你会收到一条简短说明解释原因，而不是补丁。

补丁会以 F .patch 的形式存放在报告的 patches/ 文件夹中。没有任何内容会被自动应用：

补丁说明明确指出如果修改的代码没有被仓库测试覆盖，会说明验证依赖于代码审查而非测试执行。Anthropic 建议每个补丁应通过单独的拉取请求来应用。

该插件需要付费计划，并且需要 Claude Code v2.1.154 或更高版本，同时在 /config 启用动态工作流。还需要在 PATH 中安装 Python 3.9.6 或更高版本，并以 python3 运行（仅使用标准库），以及 Git 用于变更扫描和补丁。Linux、macOS 和 Windows 均受支持，扫描会计入你的计划令牌限制。

在你的权限下运行时，扫描自身不增加隔离，这意味着已提交的 .claude/ 设置、钩子和 CLAUDE.md 仍然有效。虽然它把仓库内容视作数据而非指令，但这不能防御恶意仓库；请使用 sandbox-runtime：https://github.com/anthropic-experimental/sandbox-runtime 对不熟悉的代码库进行沙箱处理。

此外，扫描具有非确定性，不能替代传统的静态分析、依赖扫描或代码审查。

来源：Claude Security 插件文档：https://code.claude.com/docs/en/claude-security，Claude Security 产品页面：https://claude.com/product/claude-security，插件源码，claude-plugins-official：https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security，@claudeai 公告：https://x.com/claudeai/status/2079990597973057691 以及 Claude Security 公测博客：https://claude.com/blog/claude-security-public-beta

Michal Sutter 是一名数据科学专业人士，拥有帕多瓦大学数据科学硕士学位。凭借在统计分析、机器学习和数据工程方面的扎实基础，Michal 擅长将复杂的数据集转化为可操作的洞察。

构建一个具有自主能力的活动场地运营商 [完整代码]：https://pxllnk.co/twdn5

谢谢！我们的团队会尽快与您联系 🙌

Anthropic has released the Claude Security plugin for Claude Code in beta. The plugin runs a multi-agent vulnerability scan of a repository from inside an existing Claude Code session, then turns the findings you select into patch files that you review and apply yourself. Anthropic emphasized the tool’s versatility upon announcement, highlighting its capability to either run a comprehensive scan across the full codebase or inspect changes from the terminal right before a commit.

The plugin adds a single command, /claude-security, which opens a menu of three jobs, per the official documentation：https://code.claude.com/docs/en/claude-security:

Installation is two commands from the official Anthropic marketplace：https://code.claude.com/docs/en/discover-plugins#official-anthropic-marketplace:

If the marketplace is not found, run /plugin marketplace add anthropics/claude-plugins-official first. The plugin source is public in the claude-plugins-official repository：https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security, currently at version 0.10.0.

The scan is implemented as a dynamic workflow：https://code.claude.com/docs/en/workflows — a JavaScript orchestration script that fans work out across subagents. The script declares six phases:

Research runs against four fixed categories: injection-and-input, auth-and-access, memory-and-unsafe, and crypto-and-secrets. The memory-and-unsafe lens is dropped for components written entirely in memory-safe languages, so a pure Python or TypeScript component gets three lenses instead of four.

The operational scale of a run is dictated by four distinct effort tiers: low, medium, high, and max. Depending on the selected tier, specific thresholds are enforced: the maximum number of components is capped at 12 for low and medium tiers, expanding to 24 for high and max tiers; matrix cells are assigned 1 researcher, which increases to 2 at the high and max levels; and the number of gap-fill sweeps scales from 0 at low, to 1 at medium, up to 2 for high and max. When dealing with a limited scope or a small diff, the process condenses into a single-researcher configuration instead of deploying the entire matrix. This ensures the evaluation remains strictly proportionate to the target while maintaining the identical verification standard.

The system employs model-tiered agents: the orchestrator runs on Opus, while the repository cartographer and read-only code explorer run on Sonnet. Furthermore, the session model is inherited by researchers and verifiers, and scan agents are restricted exclusively to read-only tools.

This is the part worth understanding closely. A candidate finding does not go into the report because a researcher found it. It goes in only after surviving a panel.

Each candidate is handed to three independent verifiers, one per lens: REACHABILITY , IMPACT , and DEFENSES . Each returns a structured verdict of TRUE_POSITIVE or FALSE_POSITIVE with one or two lines naming the decisive file:line. The keep quorum is 2 of 3. If fewer than three voters return, the candidate is not keepable at all.

The panel result also caps the finding’s stated confidence. A unanimous 3/3 panel allows a confidence ceiling of high; a 2/3 quorum caps it at medium. A finding cannot claim more confidence than its verification earned.

Critically, the tally is computed in Python by the report renderer, not asserted by the model that produced the findings. The revision stamp’s verification.status is set to verified only when the vote record proves the panel ran for every finding in the report; otherwise it is unverified with a stated reason. That makes the report’s own account of its rigor something you can check rather than something you take on trust.

Every scan writes a timestamped CLAUDE-SECURITY- / directory into the repository containing three artifacts:

That directory is the only change a scan makes to your checkout, and it ships with its own .gitignore so a stray git add cannot sweep a report into a commit. Deleting that one .gitignore lets you commit the report for an audit trail.

The fix job develops each patch in a scratch clone of the repository, so your working tree and index are never touched. An agent independent of the one that wrote the patch then reviews the staged diff and runs the project’s own test suite against the change.

A patch file is written only if the verifier can state all three of these with confidence: the change addresses that one finding, it introduces no new vulnerability, and behavior is otherwise unchanged — where a change to which inputs the code accepts counts as a behavior change. Any change that weakens security while claiming to fix it, such as a loosened auth check or a disabled test, is an automatic reject. When the verifier cannot vouch for all three, you get a short note explaining why instead of a patch.

Patches land in the report’s patches/ folder as F .patch. Nothing is applied automatically:

The patch note explicitly indicates if no repository test covers the modified code, clarifying that the verification relies on code review rather than test execution. Anthropic suggests that each patch should be applied using an individual pull request.

The plugin requires a paid plan with Claude Code v2.1.154 or later, with dynamic workflows enabled in /config. It also needs Python 3.9.6 or later on your PATH as python3 (using only the standard library) and Git for change scans and patching. Linux, macOS, and Windows are supported, and scans count against your plan’s token limits.

Running in your session under your permissions, the scan adds no isolation of its own , meaning committed .claude/ settings, hooks, and CLAUDE.md still apply. While it treats repository content as data rather than instructions, this is not a defense against hostile repositories; use sandbox-runtime：https://github.com/anthropic-experimental/sandbox-runtime to sandbox unfamiliar codebases.

Additionally, scans are nondeterministic and do not replace traditional static analysis, dependency scanning, or code reviews.

Sources: Claude Security plugin documentation：https://code.claude.com/docs/en/claude-security, Claude Security product page：https://claude.com/product/claude-security, Plugin source, claude-plugins-official：https://github.com/anthropics/claude-plugins-official/tree/main/plugins/claude-security, @claudeai announcement：https://x.com/claudeai/status/2079990597973057691 and Claude Security public beta blog：https://claude.com/blog/claude-security-public-beta

Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.

Build an Agentic Event Venue Operator [Full Codes]：https://pxllnk.co/twdn5

Thanks! Our team will contact you soon 🙌