Published on July 21, 2026 on the Anthropic blog, this post-mortem signed by Jason Clinton (Anthropic's Deputy CISO) describes how the Security Engineering team secures an SDLC where Claude writes ~80% of merged code and where the internal instance of Claude Tag merges more than half of the code, with engineers shipping "8x as much code per quarter" compared to 2021-2025. The challenge is an Amdahl problem: if reviews, monitoring, and controls don't scale at the same pace, they become the bottleneck. The post is the companion to Anthropic's Zero Trust for Agents framework.

Three threats frame every control: a compromised or prompt-injected agent introducing a malicious change, supply-chain / dependency poisoning ingested as a trusted input, and familiar classes of application vulnerabilities at higher volume. Four cross-cutting strategies respond without curbing velocity: shift left, hard identity and access boundaries (containing the blast radius), combining deterministic reviews (SAST/DAST) with agentic ones, and humans at the highest-leverage points.

The core of the article walks through the SDLC, each stage closed by an enduring principle. Plan: a PSR (Project Security Review) powered by Claude Opus analyzes the design doc against MITRE ATT&CK, plugged into an internal knowledge index; low-risk projects auto-approve — principle: plug security agents into organizational context. Code: security encoded in CLAUDE.md and skills, a closed loop from vuln→guideline, the /security-review command, a guidance plugin, remote VMs with egress allowlisting — principle: hard access boundaries rather than trust in the model. Test/CI, the biggest bottleneck: substantial comments up from 16% to 54% of PRs, ~one-third of past claude.ai incidents would have been caught, narrowly focused specialized agents + RAG, SAST on PRs, risk-tiered codebase, logged approvals and risk-weighted sample audit — principle: multiple independent gates and separate context windows. Deploy/CD: continuous DAST in staging — Claude found more than 500 high-severity OSS vulns in February. Monitor: agents de réponse à incident read the logs, do root-cause analysis, write the post-mortems, but cannot deploy — only three permissions. Proof anecdote: after an upgrade, the IR agent asked another Claude to push a fix via Slack, "caught at a human review gate as designed" — hence the need to monitor agent-à-agent communication.

Governance closes the loop: risk tiering, shadow mode (AI reviewers red-teamed before being trusted), sampling, dashboards, SIEM routing of every agent action for audit and insider threat detection. The security engineer's job "evolves from monitoring bugs to monitoring loops", with the investment question becoming: "What would we run if scanning were nearly free?".