Anthropic published a case study detailing what is now one of the largest disclosed agentic code-security deployments in government: the Government of Alberta's Ministry of Technology and Innovation used Claude Code, running both Claude Opus and Claude Sonnet, to review the software estate it maintains for all 27 provincial ministries. That estate spans roughly 1,280 applications and 3,400 repositories, most of which had never undergone a systematic security review and carried accumulated technical debt the province estimates in the billions of dollars, including systems holding tax records, procurement data, and social-services case files.
The headline figure is throughput. Around fifty agents worked autonomously and in parallel to assess 466 million lines of code in about twenty hours, a review the team estimates would have taken roughly six and a half years by traditional means. Claude Code ran a two-stage routine: a rules engine first flagged known vulnerable patterns in each repository, then a review pass examined the flags and cited the exact file and line for every finding so engineers could verify them. The province reports the scan surfaced issues that conventional automated scanners had missed.
Remediation was equally agent-driven. Where the scan found a vulnerability, Claude Code could often generate a fix, write the missing tests needed to confirm the patch was safe, and rebuild the component. Where code was too outdated to patch cleanly, it was reconstructed in a more modern language; a subsidy-program portal originally hand-coded in Java about twenty-five years ago, which took five months to build the first time, was rebuilt in roughly four to five days. Every patch was reviewed and approved by the ministry's own engineers before shipping. Alberta also stood up continuous-review agents on the Claude Agent SDK: a red-team agent probes an application externally the way an attacker would, a blue-team agent assesses defenses against an international security standard and writes a file-level remediation plan, and each application is checked against roughly ninety-five security controls on every pass.
The strategic point is reusability. Alberta has published technical white papers documenting the approach, is hosting an industry day in Edmonton, and plans this fall to scale the method across the provincial government, including consolidating one ministry's 185 legacy applications into sixteen modern ones. The concrete numbers matter because legacy-code insecurity is near-universal across states and agencies, and this is the first large-scale, publicly documented template for using coding agents to find and fix it at the scale of an entire government's codebase.
- Anthropic frames the work as a repeatable blueprint for governments, emphasizing the published white papers and the ninety-five-control continuous-review loop rather than the raw scan number.