Anthropic’s AI Bug Hunter Jolts Cyber Stocks

Security teams have long operated like firefighters handed buckets while the fires keep multiplying. Anthropic launched what it says is a fire hose, sparking a Friday selloff of cybersecurity stocks.

See Also: Agentic AI and the Future of Automated Threats

Claude Code Security, released Friday in a limited research preview, scans codebases for security vulnerabilities and suggests patches. It is currently open to enterprise and team customers, with expedited free access for maintainers of open-source repositories.

“We expect that a significant share of the world’s code will be scanned by AI in the near future, given how effective models have become at finding long-hidden bugs and security issues,” the company wrote.

Conventional static analysis tools, which dominate automated security testing, work by matching code against a catalog of known problem patterns. They catch common issues reliably, but tend to miss flaws that require contextual reasoning: broken access controls, business logic errors and vulnerabilities that become dangerous when components interact in a specific sequence.

Anthropic says Claude Code Security approaches the problem differently. Rather than scanning for known patterns, it reads and reasons through code the way a human security researcher would, tracing how data moves through an application, mapping how components depend on one another and surfacing complex, context-dependent vulnerabilities that rule-based tools routinely overlook. Every finding passes through a multi-stage verification process in which the model attempts to confirm or disprove its own results. The findings arrive with severity ratings and confidence scores, and a patch does not get implemented without a developer’s approval.

Anthropic used Claude Opus 4.6 to find over 500 vulnerabilities in production open-source codebases – bugs that had gone undetected for decades despite years of expert review. The company says it is working through triage and responsible disclosure.

Cybersecurity stocks fell sharply Friday, with companies like CrowdStrike, Cloudflare, Okta and SailPoint dropping 8% to 9% on an average. Software supply chain security firm JFrog plunged nearly 25%. The selloff was striking given the sector’s gains over the prior three years: CrowdStrike alone had risen close to 250% in that period.

The broader iShares Expanded Tech-Software Sector ETF has lost around 23% since the start of the year, putting it on course for its steepest quarterly decline since the 2008 financial crisis, part of a wider investor rout driven by fears that AI-assisted coding tools are compressing demand for established software products.

Companies whose core business is pattern-based code scanning, said Kobi Samboursky, managing partner at Glilot Capital, were already struggling before this launch, and will struggle more now. “The entire world of writing code is changing before our eyes. The entire process of writing code and software, their testing and security, is under threat. Companies that are involved in software development and protection of the code are on very unstable ground,” he told CTech.

Some analysts pushed back. Barclays reportedly called the selloff “illogical,” saying that Claude Code Security does not directly compete with any of the established businesses it covers.

Jefferies analyst Joseph Gallo went further, telling Bloomberg he expects the cybersecurity sector to be a net beneficiary of AI, even if stock valuations could be volatile for a period.

AI tends to be most effective at finding lower-impact bugs, and experienced human operators are necessary in most organizations to handle higher-level threats.

But investor panic may not be entirely reactionary. The companies most exposed could be firms whose primary value proposition is finding bugs that humans miss. That is now Claude’s pitch too.

“The risk for big brands is not that someone will recreate Splunk or CrowdStrike overnight,” Shay Michel, managing partner at Merlin Ventures, told CTech.

“The risk is that the costs of migration drop to almost zero, thanks to AI agents managing the migration process. You can no longer just ‘sit’ on your customers’ data and workflows and use them as a moat to keep them locked in your ecosystem. Once someone builds a product that solves the same problem better, they can now migrate your customers to it much more easily.”

Samboursky stopped well short of an industry obituary. “Claude will not wipe out the market and companies will remain here, but they will have to move to other places,” he said. “IT managers are looking for the security that cyber companies provide.”

Anthropic has been building toward this capability for over a year, stress testing Claude’s security abilities through its Frontier Red Team, entering competitive security challenges known as Capture-the-Flag events, partnering with Pacific Northwest National Laboratory on critical infrastructure defense and applying the model to its own internal codebase.