Anthropic shares a six-step framework for using Claude Opus to secure source codebases: threat modeling, sandboxing, discovery, verification, triage, and patching. Key insight is that vulnerability discovery is now easy to parallelize with LLMs, but the real bottleneck has shifted to verification and triage. The guide covers practical techniques like using independent verifier agents to cut false positives, deduplicating findings by root cause, severity scoring based on reachability and preconditions, and validating patches with adversarial re-scanning. Anthropic reports having disclosed 1,596 vulnerabilities in open source software as of May 2026, with only 97 patched so far. A reference harness and skills repo are provided to get started.
