AI-Powered Code Security: Anthropic and OpenAI Race to Protect the Software Supply Chain

The application security landscape is undergoing a rapid transformation, driven by the emergence of AI-powered vulnerability scanners. In a span of just fourteen days, Anthropic disrupted the market with Claude Code Security, and OpenAI responded with Codex Security. Both scanners leverage large language model (LLM) reasoning, a departure from traditional pattern-matching approaches, and have demonstrated the ability to identify vulnerability classes that static application security testing (SAST) tools often miss.

The Limitations of Traditional SAST

Traditional SAST tools rely on identifying known anti-patterns in code. While effective for detecting common vulnerabilities like exposed passwords or outdated encryption, they struggle with more complex flaws rooted in business logic or access control issues. LLM-based scanners, in contrast, can reason about code contextually, trace data flows, and understand developer intent, enabling them to uncover vulnerabilities that were previously undetectable.

Anthropic and OpenAI: Parallel Paths to AI-Driven Security

Anthropic initially published research on its zero-day vulnerability detection capabilities on February 5, alongside the release of Claude Opus 4.6. The model identified over 500 previously unknown high-severity vulnerabilities in open-source codebases. Claude Code Security, released as a limited research preview on February 20, is available to Enterprise and Team customers, with expedited access for open-source maintainers.

OpenAI’s Codex Security evolved from Aardvark, an internal tool powered by GPT-5. During its beta period, Codex Security scanned over 1.2 million commits, identifying 792 critical and 10,561 high-severity findings across repositories like OpenSSH, GnuTLS, and Chromium, resulting in 14 assigned Common Vulnerabilities and Exposures (CVEs).

The Dual-Apply Dilemma and the Require for Speed

The capabilities demonstrated by Anthropic and OpenAI present a “dual-use” challenge. If these tools can find vulnerabilities, so too can malicious actors with API access. Security experts advise treating vulnerabilities surfaced by these models as zero-day class discoveries, emphasizing the need to compress the window between discovery and exploitation. The speed at which both companies are iterating – with model updates on monthly cycles – further intensifies this pressure.

What This Means for the Enterprise Security Stack

While these new AI-powered scanners represent a significant advancement, they do not replace existing security tools. Instead, they shift the focus and procurement math. According to security leaders, the budget is likely to move toward runtime and exploitability layers, AI governance, and remediation automation. The commoditization of static code scanning is anticipated, with a move away from expensive SAST licenses toward tooling that accelerates the remediation process.

Seven Steps to Prepare for the New Landscape

1. Run Both Scanners: Compare findings from Claude Code Security and Codex Security against existing SAST output.
2. Build a Governance Framework: Treat these tools as new data processors for sensitive source code, establishing clear agreements regarding data handling and intellectual property.
3. Map Coverage Gaps: Recognize that these scanners focus on code reasoning and do not cover areas like software composition analysis or runtime detection.
4. Quantify Dual-Use Exposure: Assume adversaries are leveraging the same models to identify vulnerabilities.
5. Prepare a Board Comparison: Highlight the differences in approach between Claude Code Security and Codex Security, emphasizing the value of diverse reasoning systems.
6. Set a 30-Day Pilot Window: Evaluate both scanners against a representative codebase to inform procurement decisions.
7. Track the Competitive Cycle: Monitor the rapid pace of development and feature releases from both Anthropic and OpenAI.

The race between Anthropic and OpenAI is accelerating the evolution of application security. By embracing these new AI-powered tools and adapting their security strategies, organizations can better protect their software supply chains and mitigate the risks posed by increasingly sophisticated threats.