Anthropic says the Government of Alberta used Claude Code with Opus and Sonnet models to scan 466 million lines of government code in 20 hours.
The July 6 case study describes a team inside Alberta’s Ministry of Technology and Innovation using about 50 agents in parallel across roughly 1,280 applications and 3,400 repositories. The work targeted security vulnerabilities, infrastructure weaknesses, deployment gaps, and missing technical documentation.
Anthropic says the scanning routine used a two-stage process: a rules engine first flagged known patterns, then Claude Code reviewed those flags and cited exact files and lines so developers could verify the findings.
The claim is scale plus review
The Alberta case study is not just a coding-agent demo. It is a government modernization story, because the systems involved hold sensitive records across ministries, including tax, procurement, and social-services data.
Anthropic says Claude Code could often generate a fix, test it, and build it after a vulnerability was found. Where automated tests were missing, Claude wrote tests first. Where a system was too old or complex to patch efficiently, the team could rebuild it in a more maintainable language.
The case study still keeps humans in the release path. Anthropic says patches were reviewed and approved by ministry engineers before shipping.
That distinction matters. A scan that produces 20 hours of findings can create its own risk if teams cannot triage, verify, test, and approve the output.
Alberta is turning the scan into process
The more durable part of the story is continuous review. Alberta’s cybersecurity team built specialized Claude review agents on top of the Claude Agent SDK.
Anthropic describes a red-team agent that probes applications from the outside and maps possible exploitation paths, followed by a blue-team agent that checks defenses against an international security standard and writes remediation plans with file-level pointers. Additional agents review code quality and public-facing writing.
The case study says every application is checked against roughly 95 security controls on each pass.
Alberta also plans to expand from review and remediation into broader modernization. Anthropic says one ministry has 185 legacy production applications that the government wants to consolidate into 16 reusable applications.
