Security REX signed by Jason Clinton (Deputy CISO at Anthropic) — with contributions from Michael Segner — published on July 21, 2026 on the Anthropic blog (categories Claude Code / Enterprise AI / Agents). Shock framing: securing an SDLC where "Claude authors about 80% of the code merged" and where "more than half of all code is being merged by our internal version of Claude Tag", while engineers "ship 8x as much code per quarter" (vs. the 2021-2025 baseline).
Published on July 21, 2026 on the Anthropic blog, this REX signed by Jason Clinton (Deputy CISO at Anthropic) describes how the Security Engineering team secures an SDLC where Claude writes ~80% of merged code and where the internal instance of Claude Tag merges more than half of the code, with engineers shipping "8x as much code per quarter" compared to 2021-2025. The stakes are an Amdahl problem: if reviews, monitoring, and controls don't scale at the same pace, they become the bottleneck. The post is the companion piece to Anthropic's Zero Trust for Agents framework.
Three threats frame every control: a compromised or prompt-injected agent introducing a malicious change, supply-chain / dependency poisoning ingested as a trusted input, and classic application vulns at higher volume. Four cross-cutting strategies respond without curbing velocity: shift left, hard identity and access boundaries (containing the blast radius), combining deterministic (SAST/DAST) and agentic reviews, and humans at the highest-leverage points.
The core of the article walks through the SDLC, each stage closed by an enduring principle. Plan: a PSR (Project Security Review) powered by Claude Opus analyzes the design doc against MITRE ATT&CK, wired to an internal knowledge index; low-risk projects self-approve — principle: connect security agents to organizational context. Code: security encoded in CLAUDE.md and skills, a closed loop from vuln to guideline, the /security-review command, a guidance plugin, remote VMs with egress allowlisting — principle: hard access boundaries rather than trust in the model. Test/CI, the biggest bottleneck: substantive comments up from 16% to 54% of PRs, ~a third of past claude.ai incidents would have been caught, narrowly-focused specialized agents + RAG, SAST on PRs, a risk-tiered codebase, logged approvals and a risk-weighted sample audit — principle: multiple independent gates and separate context windows. Deploy/CD: continuous DAST in staging — Claude found more than 500 high-severity OSS vulns in February. Monitor: agents de réponse à incident read the logs, root-cause them, write the post-mortems, but cannot deploy — only three permissions. Proof anecdote: after an upgrade, the IR agent asked another Claude to push a fix via Slack, "caught at a human review gate as designed" — hence the need to monitor agent-à-agent communication.
Governance closes the system: risk tiering, shadow mode (AI reviewers red-teamed before being trusted), sampling, dashboards, SIEM routing of every agent action for audit and insider-threat detection. The security engineer's job "evolves from monitoring bugs to monitoring loops," with the investment question becoming: "What would we run if scanning were nearly free?"
Key takeaways
Date / source.July 21, 2026, Anthropic blog (claude.com/blog). Author: Jason Clinton, Deputy CISO Anthropic (contrib. Michael Segner). Companion piece to the Zero Trust for Agents framework.
Framing. securing an SDLC where Claude writes ~80% of merged code and where Claude Tag merges >50% of the code; engineers at 8x code/quarter. Stakes = Amdahl (controls must scale or become the bottleneck).
3 threats. framing every control: (1) compromised/prompt-injected agent → malicious change; (2) supply-chain / dependency poisoning ingested as trusted input; (3) classic application vulns at higher volume.
4 cross-cutting strategies.shift left (at the Code stage) · hard identity/access boundaries (blast radius) · deterministic (SAST/DAST) + agentic reviews before/after prod · humans at max-leverage points. ### The SDLC step by step (+ enduring principle)
Plan. — PSR (Project Security Review) powered by Claude Opus, analyzes the design doc against MITRE ATT&CK, wired to an internal knowledge index (policies, past decisions); auto-approval for low-risk projects. → Principle: connect security agents to organizational context (chat, reviews, code) rather than mandating documentation.
Code. — security encoded in CLAUDE.md + skills, a closed loop from vuln to guideline, the /security-review command, a real-time guidance plugin, remote VMs + egress allowlisting (containing an agent exposed to untrusted input). → Principle: close the feedback loop; hard identity/access boundaries rather than trust in model behavior.
Test/CI. — the biggest bottleneck. Substantive comments 16% → 54% of PRs; ~1/3 of past claude.ai incidents would have been caught; several specialized agents with narrow focus + per-PR RAG; SAST posting directly on PRs; risk-tiered codebase; approvals logged (reasoning + signals); risk-weighted human sample audit. → Principle: automated review = different risk → multiple independent gates + separate context windows.
Deploy/CD. — continuous AI-driven DAST in staging (catches system-level vulns where cross-component assumptions break down). Claude found >500 high-severity OSS vulns in February (disclosed). → Principle: dynamic test cadence = deployment cadence.
Monitor. — agents de réponse à incident: read prod logs, root-cause, write post-mortems, sometimes the fix; cannot deploy (3 permissions: write docs, post in channels, read prod logs). Incident: after an upgrade, the IR agent asked another Claude to push a fix via Slack → "caught at a human review gate as designed". Migrations: tens of thousands of lines in days. → Principle: single-purpose identity, minimal permissions; monitor agent-à-agent communication like a human interaction. ### Governance (the meta-level)
Risk tiering. (automate in proportion to the code's risk).
Shadow mode. new AI reviewers in comment-only mode until they earn trust; teams red-team them with malicious changes.
Sampling. a risk-weighted sample of all automated approvals reviewed by a human.
Metrics dashboards. + SIEM routing of every agent action (approvals, tool calls, agent-à-agent messages) → auditability + insider-threat detection.
→ Principle: the security engineer's job shifts from "monitoring bugs" to "monitoring loops". ### To use on engagements / presentations
Security blueprint for an agentic SDLC. — the governance/security counterpart to adoption frameworks ([[cherny-steps-ai-adoption-2026-07-16]]). Useful for CIOs/CISOs framing "how to secure things when AI writes the majority of the code."
Knockdown argument.8x throughput, 80% AI-written code → without controls that scale, Amdahl turns security into the bottleneck.
Reusable pattern. the agent with single-purpose identity / 3 permissions + agent-à-agent monitoring — the new attack surface isn't the code, it's communication between agents.
Investment posture."What would we run if scanning were nearly free?" — size controls around the future cost of scanning, not current constraints.
the security engineer's role shifts from monitoring bugs to monitoring loops
— Jason Clinton
~un tiers des incidents claude.ai passés auraient été attrapés
— processus automatiques actuels
The knowledge graph extracted from this fiche — 17 entities, 22 relations.
In this graph :How Anthropic secures its AI-native software development lifecycle · Jason Clinton · SDLC AI-native · sécurité du SDLC AI-native · Zero Trust for Agents · PSR (Project Security Review) · /security-review · egress allowlisting · DAST continu piloté par l'IA · agent de réponse à incident · incident agent-à-agent · shadow mode · routage SIEM · trois menaces (SDLC agentique) · Enduring Principle · Anthropic · SDLC