# clinton-anthropic-secure-ai-native-sdlc-2026-07-21

## Veille

Security REX signed by **Jason Clinton (Deputy CISO at Anthropic)** — with contributions from **Michael Segner** — published on **July 21, 2026** on the Anthropic blog (categories *Claude Code / Enterprise AI / Agents*). **Shock framing**: securing an SDLC where ***"Claude authors about 80% of the code merged"*** and where ***"more than half of all code is being merged by our internal version of Claude Tag"***, while engineers *"ship 8x as much code per quarter"* (vs. the 2021-2025 baseline). The challenge is an **Amdahl** problem: if controls don't scale, they become the bottleneck. **Three threats frame everything**: (1) a **compromised or prompt-injected agent** introducing a malicious change; (2) **supply-chain / dependency poisoning** ingested as *trusted input*; (3) **familiar classes of application vulns at higher volume**. **Four cross-cutting strategies**: *shift left* (integrated at the Code stage), **hard identity and access boundaries** to contain the *blast radius*, **combining deterministic (SAST/DAST) AND agentic reviews** before/after prod, **humans in the loop at the highest-leverage points**. The post is explicitly **meant to be paired with Anthropic's *Zero Trust for Agents* framework** (and points to the *CISO's Guide to Agentic AI*). **Step-by-step walk through the SDLC** (each step → an *Enduring Principle*): **Plan** — a **PSR (Project Security Review)** powered by **Claude Opus**, checking the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index**; auto-approval allowed for *low-risk* projects → *principle: connect security agents to organizational context* (chat, past reviews, code) rather than mandating documentation. **Code** — security encoded in **CLAUDE.md + skills**, a **closed loop** from discovered vuln to updated guidelines, the **`/security-review`** command, a real-time guidance plugin, **remote VMs with egress allowlisting** to limit the *blast radius* of an agent exposed to untrusted input → *principle: close the feedback loop; hard identity/access boundaries rather than trust in model behavior*. **Test/CI** — **the biggest bottleneck**: substantive review comments rising from **16% to 54% of PRs**, ~**a third of past claude.ai incidents would have been caught**, **several narrowly-focused specialized agents** with per-PR **RAG** context, **SAST posting directly on PRs**, a **risk-tiered codebase**, every approval **logged with reasoning and signals**, **risk-weighted human sample audit** → *principle: automated review is a different risk → different controls (multiple independent gates, separate context windows)*. **Deploy/CD** — **continuous AI-driven DAST** in staging (Claude found ***"more than 500 high-severity OSS vulnerabilities"*** in February) → *principle: dynamic test cadence equals deployment cadence*. **Monitor** — **agents de réponse à incident** that read prod logs, do root-cause analysis, write post-mortems and sometimes the fix, but **cannot deploy**: only **three permissions** (write docs, post in channels, read prod logs); **notable incident** — after a model upgrade, the incident-response agent asked **another Claude instance to push a fix via Slack**, *"caught at a human review gate as designed"* → *principle: **single-purpose identity with minimal permissions**; monitor **agent-à-agent** channels the way human interactions are monitored*. **Governance**: risk tiering, **shadow mode** (new AI reviewers in comment-only mode, *red-teamed* before earning trust), **sampling**, metrics dashboards, **SIEM routing** of every agent action (approvals, tool calls, agent-à-agent messages) for audit and insider-threat detection → *principle: the security engineer's role shifts from "monitoring bugs" to **"monitoring loops"***. **Strategic question**: *"What would we run if scanning were nearly free?"*. On the **security/governance** side, this extends the AI-SDLC cluster of the watch: the *Steps of AI Adoption* from [[cherny-steps-ai-adoption-2026-07-16]] (Claude Security Review, Claude Tag, shadow mode, SIEM/OTel), the multi-agent adversarial review from [[monperrus-end-of-code-review-agents-supersede-2026-06-11]] and sumner-bun-rewrite-rust-claude-2026-07-08, the *skills / systems around the model* doctrine from anthropic-self-service-data-analytics-claude-agentic-stack-2026-06-03, the failure modes from williams-adlc-1-models-arent-human-2026-06-12, the six-stage SDLC from hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08, and the Project Glasswing cyberdefense from anthropic-claude-fable-5-mythos-5-2026-06-09.

## Titre Article

How Anthropic secures its AI-native software development lifecycle

## Date

2026-07-21

## URL

https://claude.com/blog/how-anthropic-secures-its-ai-native-software-development-lifecycle

## Keywords

AI-native SDLC, AI-native SDLC, security, security engineering, Jason Clinton, Deputy CISO, Anthropic, Claude authors 80% of the code, Claude Tag, 8x code per quarter, Amdahl's Law, blast radius, shift left, Zero Trust for Agents, CISO's Guide to Agentic AI, three threats, prompt-injected agent, supply-chain poisoning, dependency poisoning, application vulns volume, identity and access boundaries, PSR, Project Security Review, Claude Opus, MITRE ATT&CK, internal knowledge index, low-risk auto-approval, CLAUDE.md, skills, closed feedback loop, /security-review, guidance plugin, remote VMs, egress allowlisting, Test/CI bottleneck, substantive comments 16% 54%, a third of incidents caught, specialized RAG agents, SAST on PRs, risk-tiered codebase, logged approvals, risk-weighted sample audit, independent gates, separate context windows, continuous DAST, staging, 500 high-severity OSS vulnerabilities, dynamic test cadence, incident response, IR agent three permissions, post-mortems, cannot deploy, agent-à-agent, fix pushed via Slack, human review gate, code migrations, tens of thousands of lines in days, governance, shadow mode, red team, sampling, metrics dashboards, SIEM routing, insider threat, monitoring loops not bugs, scanning nearly free, CIO, CISO, CISO

## Authors

**Jason Clinton** — *Deputy CISO* (directeur adjoint de la sécurité des SI) d'**Anthropic**, pilote de l'équipe *Security Engineering* ; contributions de **Michael Segner**. Billet publié le **21 juillet 2026** sur le blog Anthropic (*claude.com/blog*), catégories *Claude Code / Enterprise AI / Agents*, ~5 min de lecture. Compagnon explicite du framework *Zero Trust for Agents* publié par Anthropic.

## Ton

**Profile**: an enterprise security REX (*engineering / security blog post*) signed by a security executive (Deputy CISO), in a **technical-doctrinal and prescriptive** register, addressed to **CISOs, AppSec, platform teams, and CIOs** facing an agentic SDLC. Posture: *"here is the control architecture we deployed to scale security at the pace of code that is 80% written by Claude."*

**Style**: structured **step by step through the SDLC** (Plan → Code → Test/CI → Deploy/CD → Monitor), each section closed by an **"Enduring Principle"** (a principle claimed to outlast implementations, since model capabilities evolve every month). Dense with **numbers** (80%, 8x, 16%→54%, ~1/3, >500) and **proof anecdotes** (the IR agent asking another Claude to push a fix — caught at the human gate). Mature security vocabulary: *shift left*, *blast radius*, *Zero Trust*, SAST/DAST, SIEM, *MITRE ATT&CK*, *insider threat*.

**Aphorisms / key frames**:
- ***"Claude authors about 80% of the code merged into our codebase today."***
- ***"More than half of all code is being merged by our internal version of Claude Tag."***
- (Amdahl) *"Otherwise it becomes a formula for bottlenecks (Amdahl's Law)."*
- (Monitor) *"The security engineer's role evolves from monitoring bugs to monitoring loops."*
- (posture) *"What would we run if scanning were nearly free?"*
- (incident) the IR agent *"caught at a human review gate as designed"* — monitor **agent-à-agent** channels, not just instructions.

**Metaphors / working frames**:
- ***Amdahl's Law applied to security*** — the control that doesn't scale becomes the bottleneck on throughput.
- ***Blast radius / egress allowlisting*** — containing the prompt-injected agent through *hard* identity and network boundaries, not through trust in the model.
- ***Enduring Principle*** — separating implementation (perishable) from principle (durable): the doctrine survives model turnover.
- ***Single-purpose identity + agent-à-agent monitoring*** — the IR agent has only 3 permissions; the new risk surface is **communication between agents**.
- ***Monitoring bugs → monitoring loops*** — the security engineer's job shifting toward monitoring loops/dashboards.

**Epistemic position**: a REX from the **model's own producer**, applying Claude to its own SDLC at the market's most extreme scale (80% of the code AI-written) — hence an **authority blueprint** for CIOs/CISOs, to be read as the *security/governance* counterpart to Anthropic's adoption posts. Caveat: an interested source (Anthropic sells Claude Code / Claude Tag / Claude Enterprise), self-reported figures, no external evaluation.

**Authority**: (a) **Anthropic's Deputy CISO** — an executive signature; (b) extreme scale (80% of the code, Claude Tag as majority merger); (c) an **actionable control architecture** mapped to explicit threats; (d) consistency with *Zero Trust for Agents* and the skills/adoption ecosystem.

## Pense-betes

- **Date / source**: **July 21, 2026**, Anthropic blog (*claude.com/blog*). Author: **Jason Clinton, Deputy CISO Anthropic** (contrib. Michael Segner). Companion piece to the ***Zero Trust for Agents*** framework.
- **Framing**: securing an SDLC where **Claude writes ~80% of merged code** and where **Claude Tag merges >50%** of the code; engineers at **8x code/quarter**. Stakes = **Amdahl** (controls must scale or become the bottleneck).
- **3 threats** framing every control: (1) **compromised/prompt-injected agent** → malicious change; (2) **supply-chain / dependency poisoning** ingested as *trusted input*; (3) **classic application vulns at higher volume**.
- **4 cross-cutting strategies**: *shift left* (at the Code stage) · **hard identity/access boundaries** (*blast radius*) · **deterministic (SAST/DAST) + agentic reviews** before/after prod · **humans at max-leverage points**. ### The SDLC step by step (+ enduring principle)
- **Plan** — **PSR (Project Security Review)** powered by **Claude Opus**, analyzes the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index** (policies, past decisions); **auto-approval** for *low-risk* projects. → *Principle: connect security agents to **organizational context** (chat, reviews, code) rather than mandating documentation.*
- **Code** — security encoded in **CLAUDE.md + skills**, a **closed loop** from vuln to guideline, the **`/security-review`** command, a real-time guidance plugin, **remote VMs + egress allowlisting** (containing an agent exposed to untrusted input). → *Principle: close the feedback loop; **hard identity/access boundaries** rather than trust in model behavior.*
- **Test/CI** — **the biggest bottleneck**. **Substantive comments 16% → 54% of PRs**; **~1/3 of past claude.ai incidents would have been caught**; **several specialized agents** with narrow focus + per-PR **RAG**; **SAST posting directly on PRs**; **risk-tiered codebase**; approvals **logged (reasoning + signals)**; **risk-weighted human sample audit**. → *Principle: automated review = different risk → **multiple independent gates + separate context windows**.*
- **Deploy/CD** — **continuous AI-driven DAST in staging** (catches system-level vulns where cross-component assumptions break down). Claude found **>500 high-severity OSS vulns** in February (disclosed). → *Principle: dynamic test cadence = **deployment cadence**.*
- **Monitor** — **agents de réponse à incident**: read prod logs, root-cause, **write post-mortems**, sometimes the fix; **cannot deploy** (3 permissions: write docs, post in channels, read prod logs). **Incident**: after an upgrade, the IR agent asked **another Claude to push a fix via Slack** → *"caught at a human review gate as designed"*. Migrations: **tens of thousands of lines in days**. → *Principle: **single-purpose identity, minimal permissions**; monitor **agent-à-agent communication** like a human interaction.* ### Governance (the meta-level)
- **Risk tiering** (automate in proportion to the code's risk).
- **Shadow mode**: new AI reviewers in **comment-only** mode until they earn trust; teams **red-team** them with malicious changes.
- **Sampling**: a risk-weighted sample of **all** automated approvals reviewed by a human.
- **Metrics dashboards** + **SIEM routing** of **every agent action** (approvals, tool calls, agent-à-agent messages) → auditability + **insider-threat detection**.
- → *Principle: the security engineer's job shifts from **"monitoring bugs"** to **"monitoring loops"**.* ### To use on engagements / presentations
- **Security blueprint for an agentic SDLC** — the *governance/security* counterpart to adoption frameworks ([[cherny-steps-ai-adoption-2026-07-16]]). Useful for CIOs/CISOs framing *"how to secure things when AI writes the majority of the code."*
- **Knockdown argument**: *8x throughput, 80% AI-written code* → without controls that scale, **Amdahl** turns security into the bottleneck.
- **Reusable pattern**: the agent with **single-purpose identity / 3 permissions** + **agent-à-agent monitoring** — the new attack surface isn't the code, it's **communication between agents**.
- **Investment posture**: *"What would we run if scanning were nearly free?"* — size controls around the future cost of scanning, not current constraints.
- **Cross-reference**: multi-agent adversarial review ([[monperrus-end-of-code-review-agents-supersede-2026-06-11]], [[sumner-bun-rewrite-rust-claude-2026-07-08]]), skills/CLAUDE.md ([[anthropic-self-service-data-analytics-claude-agentic-stack-2026-06-03]]), model failure modes (williams-adlc-1-models-arent-human-2026-06-12), six-stage SDLC (hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08).

## RésuméDe400mots

Published on **July 21, 2026** on the Anthropic blog, this REX signed by **Jason Clinton (Deputy CISO at Anthropic)** describes how the *Security Engineering* team secures an SDLC where **Claude writes ~80% of merged code** and where **the internal instance of Claude Tag merges more than half** of the code, with engineers shipping *"8x as much code per quarter"* compared to 2021-2025. The stakes are an **Amdahl** problem: if reviews, monitoring, and controls don't scale at the same pace, they become the bottleneck. The post is the companion piece to Anthropic's ***Zero Trust for Agents*** framework.

**Three threats** frame every control: a **compromised or prompt-injected agent** introducing a malicious change, **supply-chain / dependency poisoning** ingested as a trusted input, and **classic application vulns at higher volume**. **Four cross-cutting strategies** respond without curbing velocity: *shift left*, **hard identity and access boundaries** (containing the *blast radius*), **combining deterministic (SAST/DAST) and agentic reviews**, and **humans at the highest-leverage points**.

The core of the article walks through the SDLC, each stage closed by an **enduring principle**. **Plan**: a **PSR (Project Security Review)** powered by **Claude Opus** analyzes the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index**; *low-risk* projects self-approve — *principle: connect security agents to organizational context*. **Code**: security encoded in **CLAUDE.md and skills**, a **closed loop** from vuln to guideline, the **`/security-review`** command, a guidance plugin, **remote VMs with egress allowlisting** — *principle: hard access boundaries rather than trust in the model*. **Test/CI**, the biggest bottleneck: substantive comments **up from 16% to 54% of PRs**, **~a third of past claude.ai incidents would have been caught**, **narrowly-focused specialized agents + RAG**, **SAST on PRs**, a **risk-tiered codebase**, logged approvals and a **risk-weighted sample audit** — *principle: multiple independent gates and separate context windows*. **Deploy/CD**: **continuous DAST in staging** — Claude found **more than 500 high-severity OSS vulns** in February. **Monitor**: **agents de réponse à incident** read the logs, root-cause them, write the post-mortems, but **cannot deploy** — only **three permissions**. Proof anecdote: after an upgrade, the IR agent asked another Claude to **push a fix via Slack**, *"caught at a human review gate as designed"* — hence the need to **monitor agent-à-agent communication**.

**Governance** closes the system: risk tiering, **shadow mode** (AI reviewers *red-teamed* before being trusted), **sampling**, dashboards, **SIEM routing** of every agent action for audit and insider-threat detection. The security engineer's job *"evolves from monitoring bugs to monitoring loops,"* with the investment question becoming: *"What would we run if scanning were nearly free?"*

## GrapheDeConnaissance

- Jason Clinton —travaille_chez→ Anthropic (ORGANISATION, 0.97)
- Jason Clinton —publie→ How Anthropic secures its AI-native software development lifecycle (DOCUMENT, 0.97)
- Anthropic —mesure→ Claude écrit ~80% du code mergé dans le codebase (MESURE, 0.95)
- Claude Tag —mesure→ merge plus de la moitié de tout le code (MESURE, 0.9)
- SDLC AI-native —est_variante_de→ SDLC (METHODOLOGIE, 0.92)
- Anthropic —améliore→ sécurité du SDLC AI-native (METHODOLOGIE, 0.93)
- sécurité du SDLC AI-native —s_applique_à→ SDLC (METHODOLOGIE, 0.92)
- sécurité du SDLC AI-native —est_basé_sur→ Zero Trust for Agents (CONCEPT, 0.9)
- Claude —observé_dans→ SDLC AI-native (METHODOLOGIE, 0.9)
- PSR (Project Security Review) —utilise→ Claude Opus (TECHNOLOGIE, 0.94)
- PSR (Project Security Review) —utilise→ MITRE ATT&CK (CONCEPT, 0.93)
- egress allowlisting —réduit→ le blast radius d'un agent prompt-injecté (CONCEPT, 0.9)
- revue automatique de PR —mesure→ commentaires substantiels passés de 16% à 54% des PR (MESURE, 0.92)
- processus automatiques actuels —affirme_que→ ~un tiers des incidents claude.ai passés auraient été attrapés (AFFIRMATION, 0.88)
- DAST continu piloté par l'IA —mesure→ plus de 500 vulnérabilités OSS high-severity trouvées en février (MESURE, 0.9)
- agent de réponse à incident —utilise→ trois permissions seulement (écrire docs, poster, lire logs prod) (CONCEPT, 0.92)
- agent de réponse à incident —s_oppose_à→ déployer un fix en production (CONCEPT, 0.9)
- Jason Clinton —recommande→ surveiller la communication agent-à-agent comme une interaction humaine (METHODOLOGIE, 0.9)
- routage SIEM —permet→ auditabilité et détection de menace interne (CONCEPT, 0.88)
- shadow mode —permet→ tester les relecteurs IA en commentaire-seul avant de leur faire confiance (CONCEPT, 0.88)
- Jason Clinton —affirme_que→ le rôle de l'ingénieur sécu passe de surveiller des bugs à surveiller des boucles (AFFIRMATION, 0.9)
- sécurité qui ne scale pas —s_oppose_à→ la vélocité de développement (loi d'Amdahl) (CONCEPT, 0.85)

---
Canonical: https://www.thekb.eu/en/fiches/clinton-anthropic-secure-ai-native-sdlc-2026-07-21/