Cybersecurity · ModernizationJuly 6, 20263 min · updated August 12, 2026

Alberta uses Claude Code to audit 466 million lines of code

Rephrased by Daillac

Software code displayed during an automated cybersecurity review

In brief

Anthropic reports that an Alberta team analyzed 466 million lines of code in 20 hours.
Roughly 50 agents reportedly worked in parallel on vulnerabilities and documentation.
The initiative also targets technical debt and modernization of older government applications.

A code audit at unusual scale

Anthropic’s case study describes about 1,280 applications and 3,400 repositories serving 27 ministries. Alberta’s Technology and Innovation team used Opus and Sonnet models to find vulnerabilities, infrastructure issues and gaps in documentation.

The systems contain sensitive tax, procurement and social-service records. Much of the code had never received a systematic security review after decades of accumulated technical debt.

466 M

lines of code reviewed in 20 hours, according to Anthropic and the Alberta government.

Vendor case study · July 6, 2026

Automation does not replace validation

Analysis speed does not prove that a finding is real or correctly fixed. A serious program still needs human review, regression tests, change traceability and risk-based prioritization. Smaller organizations should start with a well-understood critical repository and measure false positives.

How the review was organized

A rules engine first located known patterns. Claude then reviewed the alerts and pointed developers to files and lines. When a weakness was confirmed, Claude Code could propose a patch, add tests, run the build and prepare the change. The ministry says engineers reviewed and approved every deployment.

Specialized red-team and blue-team agents were also added to the development process. One searches for exploitation paths while another evaluates defences and prepares remediation plans. This turns a one-time audit into continuous review without removing human authority.

Start with a repository that already has automated tests.
Require reproducible evidence for each reported vulnerability.
Separate detection, remediation proposals and deployment authority.
Measure false positives, human validation time and avoided regressions.

These guardrails are essential when teams audit application security with AI assistance, especially when sensitive data and public services are involved.

Turn the alert into a control plan

A sector alert matters only when it changes an inventory, access rule, test, or incident procedure. Identify affected systems, owners, accessible data, and the actions each account or tool can perform.

InfographicControl plan · shareable block

Reduce exposure

Remove unnecessary access, isolate environments, and limit available secrets.

Detect

Log sensitive actions, monitor deviations, and retain investigation context.

Respond

Name decision makers, test access revocation, and document service recovery.

Prioritize by real impact

Start with systems able to expose information, modify code, or interrupt operations. Probability alone is insufficient: a rare but irreversible scenario may require stronger technical separation or human approval.