Anthropic just dropped a new security plugin for its terminal-based coding agent Claude Code, and it's exactly the kind of automated safety net developers need. Called security-guidance, it intercepts and patches vulnerabilities in real time as you write code — cutting the number of security fix suggestions on pull requests by 30 to 40 percent, according to internal benchmarks and early rollouts. Think of it as a first line of defense before human reviewers ever see your code.
Security checks happen in three stages: when you edit a file, when you end a session, and when you commit code. Editing triggers local rules that scan for known high-risk patterns like dynamic code execution (eval or child_process.exec), unsafe deserialization (pickle), and DOM injection — no LLM calls, no extra API fees. At session end, a background model asynchronously compares the Git diff of your workspace, catching logical flaws like authorization bypass, insecure direct object references, and weak encryption. And when you run git commit or git push, a deep agent review kicks in, reading the call chain, sanitizers, and surrounding context to cut down false positives.
Enterprises can write custom plain-text security rules into .claude/claude-security-guidance.md or define regex patterns in .claude/security-patterns.yaml. Those rules are loaded alongside a built-in checklist. To run the plugin, you'll need Claude Code CLI 2.1.144 or later, and Python 3.8+ in your PATH. On first activation, the system automatically sets up a virtual environment under ~/.claude/security/ and installs the Agent SDK.