- An Anthropic security engineer describes Clue, a detection and response platform built with Claude Code that consolidates the five-to-six tools and multiple query languages analysts previously juggled for a single investigation.
- Clue is connected to internal systems — data warehouses, Slack messages, and codebases — so it can contextualize alerts; a walkthrough shows Claude planning a six-step investigation of a suspicious admin-access event and surfacing a likely privilege escalation.
- Beyond investigations, Claude Code accelerates the team: a new hire shipped a suppression engine in a week instead of the planned one-to-two months, and the engineer feels they've shifted from practitioner toward researcher.
How Anthropic uses Claude in Cybersecurity
- Securing Anthropic is described as a new frontier because there's no precedent for what's being built, making cybersecurity one of the most interesting parts of the company.
- A core problem was tooling mismatch: before Clue, investigating a security event meant jumping between five to six tools and running three to four query languages over different databases, taking hours to days for a simple investigation.
- Clue is a detection and response platform built with Claude Code that connects to internal systems via tool use, querying data warehouses plus internal knowledge like Slack messages and codebases — the missing piece that contextualizes alerts for the environment.
- An investigation starts with a natural-language question (e.g. a developer gave themselves admin access — is this authorized, any credential compromise, what did they do next), and Claude produces a multi-step plan and fires queries.
- In the sample-data demo, Claude flags a classic privilege escalation, traces the source IP to a Russian data center flagged as malicious by VirusTotal, judges the event isolated, and identifies security-posture gaps with after-action items.
- The platform lets the team process immense amounts of data and alerts and raise only what a human should actually look at, producing a final investigation summary.
- Claude Code shortened delivery dramatically: a Q4 suppression-engine project estimated at one to two months was built by a new hire in a week, partly because Claude Code explains how systems are set up.
- The engineer frames Claude as giving new hires autonomy instead of throwing them in the deep end, and enabling a shift from practitioner to researcher by building tools and gaining visibility that was previously out of reach.
Detection and response platform — A security system that detects threats and supports investigating and responding to them.
Clue — Anthropic's internal detection and response platform built with Claude Code.
Privilege escalation — An attack where a user gains higher access rights than they should have, such as unauthorized admin access.
Tool use — A capability that lets Claude call external tools and systems to query data and gather information.
Credential compromise — A situation where login credentials have been stolen or misused.
VirusTotal — A threat-intelligence service used to check whether an IP, file, or domain is flagged as malicious.
Suppression engine — A security component that reduces noise by suppressing low-value or duplicate alerts.
Security posture — The overall security state of a system, including its gaps and weaknesses.
Cybersecurity at Anthropic, I would say — I'm biased, but I think it's one of the most interesting parts of the company. There's no precedent for what we're building, and so securing it is also kind of a new frontier. The thing that I've always been stuck on is that we have these tools to do this work, but a lot of them don't actually fit what the analysts or investigators, people with boots on the ground, are doing.
Before, investigating a security event would be jumping between five to six different tools, running three to four different query languages over different databases. For a simple investigation, it would take a couple hours at least and a couple days at most. And that is part of why we built Clue.
Clue is a detection and response platform that we've built with Claude Code. One thing that makes Clue so powerful is it is connected to our internal systems. So it has access via tool use to query our data warehouses, but it also has the ability to query the internal knowledge of our company — so Slack messages and our codebases. That is usually the missing piece that really helps alerts be contextualized for your environment. To note, this is just a sample set of data that I've imported into Clue, so this isn't actually Anthropic internal information.
How we start an investigation in Clue: the user, being me, would ask a question. So I say, a developer just gave themselves admin access. Is this authorized? Can you check for credential compromise and what actions they took afterwards? And so we have asked Claude to come up with a plan on how it would investigate this. It comes up with these six steps. Then it will kick off a bunch of queries. These are the tools that it's reaching out for more information to help us figure out what's going on. We see the assistant, Claude, has come back and has gathered some more information. It says this kind of looks like a pretty classic privilege escalation. Here's some of the reasons I'm coming to that verdict. And it's going to issue some more queries. This is again sample data, but the source IP, when looked up, was a Russian data center and it was flagged as malicious by VirusTotal. It then comes to — good news — this seems to be isolated, but it's also identifying there's some gaps in our security posture on this system, so there's some after-action items that we could take. And then finally, the final investigation summary that Claude will come up with and share with you all the investigations that were taken and the findings. We have this ability to go through immense amounts of data, immense amounts of alerts, and then just raise what actually a human should look at.
I had been working on our Q4 plans and I was like, okay, we're going to work on this suppression engine, and this is going to take at least one to two months. One of our new hires built it in a week. Most of it is because Claude Code is able to explain to them, here's how this is set up, here's how it's working. And it feels like, for me, when I bring people on, that I'm giving them a tool that will give them that autonomy rather than them having to kind of swim in the deep end immediately.
I'm building the tools that I wish that I had. And I'm actually able to do what I feel like is pushing from being a practitioner to being a researcher, kind of a scientist, because I'm getting to test out a lot of the ways that I've only imagined us being able to process this immense amount of data and have more visibility into our systems that previously was just out of reach.
TL;DR
- An Anthropic security engineer describes Clue, a detection and response platform built with Claude Code that consolidates the five-to-six tools and multiple query languages analysts previously juggled for a single investigation.
- Clue is connected to internal systems — data warehouses, Slack messages, and codebases — so it can contextualize alerts; a walkthrough shows Claude planning a six-step investigation of a suspicious admin-access event and surfacing a likely privilege escalation.
- Beyond investigations, Claude Code accelerates the team: a new hire shipped a suppression engine in a week instead of the planned one-to-two months, and the engineer feels they've shifted from practitioner toward researcher.
Takeaways
- Securing Anthropic is described as a new frontier because there's no precedent for what's being built, making cybersecurity one of the most interesting parts of the company.
- A core problem was tooling mismatch: before Clue, investigating a security event meant jumping between five to six tools and running three to four query languages over different databases, taking hours to days for a simple investigation.
- Clue is a detection and response platform built with Claude Code that connects to internal systems via tool use, querying data warehouses plus internal knowledge like Slack messages and codebases — the missing piece that contextualizes alerts for the environment.
- An investigation starts with a natural-language question (e.g. a developer gave themselves admin access — is this authorized, any credential compromise, what did they do next), and Claude produces a multi-step plan and fires queries.
- In the sample-data demo, Claude flags a classic privilege escalation, traces the source IP to a Russian data center flagged as malicious by VirusTotal, judges the event isolated, and identifies security-posture gaps with after-action items.
- The platform lets the team process immense amounts of data and alerts and raise only what a human should actually look at, producing a final investigation summary.
- Claude Code shortened delivery dramatically: a Q4 suppression-engine project estimated at one to two months was built by a new hire in a week, partly because Claude Code explains how systems are set up.
- The engineer frames Claude as giving new hires autonomy instead of throwing them in the deep end, and enabling a shift from practitioner to researcher by building tools and gaining visibility that was previously out of reach.
Vocabulary
Detection and response platform — A security system that detects threats and supports investigating and responding to them.
Clue — Anthropic's internal detection and response platform built with Claude Code.
Privilege escalation — An attack where a user gains higher access rights than they should have, such as unauthorized admin access.
Tool use — A capability that lets Claude call external tools and systems to query data and gather information.
Credential compromise — A situation where login credentials have been stolen or misused.
VirusTotal — A threat-intelligence service used to check whether an IP, file, or domain is flagged as malicious.
Suppression engine — A security component that reduces noise by suppressing low-value or duplicate alerts.
Security posture — The overall security state of a system, including its gaps and weaknesses.
Transcript
Cybersecurity at Anthropic, I would say — I'm biased, but I think it's one of the most interesting parts of the company. There's no precedent for what we're building, and so securing it is also kind of a new frontier. The thing that I've always been stuck on is that we have these tools to do this work, but a lot of them don't actually fit what the analysts or investigators, people with boots on the ground, are doing.
Before, investigating a security event would be jumping between five to six different tools, running three to four different query languages over different databases. For a simple investigation, it would take a couple hours at least and a couple days at most. And that is part of why we built Clue.
Clue is a detection and response platform that we've built with Claude Code. One thing that makes Clue so powerful is it is connected to our internal systems. So it has access via tool use to query our data warehouses, but it also has the ability to query the internal knowledge of our company — so Slack messages and our codebases. That is usually the missing piece that really helps alerts be contextualized for your environment. To note, this is just a sample set of data that I've imported into Clue, so this isn't actually Anthropic internal information.
How we start an investigation in Clue: the user, being me, would ask a question. So I say, a developer just gave themselves admin access. Is this authorized? Can you check for credential compromise and what actions they took afterwards? And so we have asked Claude to come up with a plan on how it would investigate this. It comes up with these six steps. Then it will kick off a bunch of queries. These are the tools that it's reaching out for more information to help us figure out what's going on. We see the assistant, Claude, has come back and has gathered some more information. It says this kind of looks like a pretty classic privilege escalation. Here's some of the reasons I'm coming to that verdict. And it's going to issue some more queries. This is again sample data, but the source IP, when looked up, was a Russian data center and it was flagged as malicious by VirusTotal. It then comes to — good news — this seems to be isolated, but it's also identifying there's some gaps in our security posture on this system, so there's some after-action items that we could take. And then finally, the final investigation summary that Claude will come up with and share with you all the investigations that were taken and the findings. We have this ability to go through immense amounts of data, immense amounts of alerts, and then just raise what actually a human should look at.
I had been working on our Q4 plans and I was like, okay, we're going to work on this suppression engine, and this is going to take at least one to two months. One of our new hires built it in a week. Most of it is because Claude Code is able to explain to them, here's how this is set up, here's how it's working. And it feels like, for me, when I bring people on, that I'm giving them a tool that will give them that autonomy rather than them having to kind of swim in the deep end immediately.
I'm building the tools that I wish that I had. And I'm actually able to do what I feel like is pushing from being a practitioner to being a researcher, kind of a scientist, because I'm getting to test out a lot of the ways that I've only imagined us being able to process this immense amount of data and have more visibility into our systems that previously was just out of reach.