On May 7, application security vendor Snyk said it had embedded Anthropic's Claude models across its AI security platform, bringing the assistant directly into security workflows already used by enterprise development teams.
At first glance, it sounds like another vendor announcement about adding an AI model. The weight of this deal is in the operating numbers: Snyk says it serves 4,500 enterprise customers, that 65% to 70% of production code in those environments is now AI-generated, and that nearly half of that AI-written code contains vulnerabilities. Each AI model deployed by an enterprise also brings in roughly three times as many additional software components, 82% of them from third-party packages.
Detection is not the bottleneck
Anthropic Deputy CISO Jason Clinton framed the issue sharply in the announcement: in AI security, detection is not the bottleneck.
The point is easy to miss unless you have lived with AppSec queues. For years, vendors competed on detection: SAST, DAST, software composition analysis, infrastructure-as-code scans, container checks and dependency alerts. Those tools can usually identify the risky line, the vulnerable open-source package or the misconfigured image. The hard part is getting a developer to understand the finding, prioritize it and ship a fix before the next wave of alerts arrives.
AI coding tools change the scale of the queue. The flow of alerts is no longer tied to a developer writing a few hundred lines a day. Copilot, Claude, Cursor and code-generation agents can push thousands of lines into a repository in seconds, while also pulling in packages, container images and tool calls. Even a fast detector does not help if the remediation pipeline cannot keep up.
Snyk Chief Innovation Officer Manoj Nair put it more directly: AI is accelerating the way developers write code, and traditional security is falling behind.
Snyk's Claude integration is therefore less about finding more issues and more about fixing them. The goal is to turn scanner findings into pull requests that developers can review and merge, inside the IDE and Git workflows they already use.
What Snyk is shipping
The announcement describes two layers. The first is Claude inside Snyk's existing AI Security Platform, where it is used across code, dependencies, containers and AI-generated assets, including agent prompts and tool definitions, for discovery, prioritization and automated remediation.
The second is Snyk Evo, a newer product aimed at red-teaming agents and AI tools. It simulates prompt-injection attacks, data leakage and runtime policy boundaries around tool calls.
That second layer matters as MCP spreads through enterprise systems. Once a company runs thousands of agents against thousands of tools, every tool definition becomes part of the attack surface. Anthropic has previously published research on 11 CVEs around MCP. One lesson from that work is that both the protocol layer and the application layer need enterprise-grade runtime protection. Snyk Evo is built for that gap.
Why Claude
Snyk did not spell out why it chose Claude over another model, but the logic is visible.
First, Claude has a strong reputation for code understanding. Anthropic's Claude Mythos has posted high scores on SWE-bench Pro, which matters for the specific task Snyk needs: understand what a piece of code is trying to do, then produce a change a developer can actually merge.
Second, Anthropic has been pushing deeper into application security itself. Its Project Glasswing work involved AWS, Apple, Cisco, Google, JPMorgan, Microsoft and others using unreleased Mythos Preview models to find critical vulnerabilities, including a decades-old OpenBSD flaw. For Snyk, the partnership brings that AppSec experience into the customer pipeline.
Third, the economics are becoming easier to justify. AppSec vendors cannot afford model costs that overwhelm subscription revenue. Recent Claude API limit increases for Opus and higher limits across Pro, Max and Team plans improve the math for deep integrations like this one.
The signal underneath
The product is also a sign of where software development is heading: one AI system, Claude, being used to repair code generated by another AI system, whether that is GitHub Copilot, Cursor or an internal code agent.
That creates a new industrial loop. AI reduces the apparent cost of producing code, but security debt can grow even faster. Enterprises can either hire more people to close the gap, or use another AI system to help do it.
With a 4,500-customer base, Snyk is betting on the second path. The integration is available now, with broader scale-out planned through 2026. The important metric may not be the size of this single deal, but how much enterprise code soon passes through a three-step pipeline: AI writes, AI reviews, AI fixes.
Sources: Snyk Embeds Anthropic's Claude to Advance AI-Powered Security for Software Development (GlobeNewswire / Yahoo Finance); CocoLoop, Snyk embeds Anthropic's Claude to scale AI-native application security (TipRanks)