"A task that was supposed to take 6.5 years was completed in 20 hours"—A Canadian provincial government tackled a large-scale security audit using 50 AI agents
"6.5 years" versus "20 hours." This extreme contrast is the content of a case study published by Anthropic on July 6th. It reports that the Alberta provincial government in Canada conducted a large-scale security audit of the entire province's systems using Claude. This article will examine this case from both a technical perspective and the process leading up to it.
The trigger was the precedent of "discovering Firefox vulnerabilities"
Tracing the origins of this initiative reveals an interesting propagation route. In February of this year, Anthropic's own team used Claude to scan the source code of the Firefox browser and discovered 22 vulnerabilities (14 of which were high-severity) in just two weeks. This is said to be roughly one-fifth of the high-severity Firefox vulnerabilities that will be fixed throughout 2025. Following these results, Mozilla, the developer, began incorporating Claude into its internal security operations.
Anthropic's report states that Alberta's cybersecurity department, after seeing the Anthropic-Mozilla case study, thought, "We could do this too," and actually began implementing it. This is a clear example of how corporate pilot projects can spread to government implementation—how AI technology permeates the field.
The Scale of "50 Agents in 20 Hours: 466 Million Lines"
Let's look at the specific work involved. The Alberta Department of Technology and Innovation manages approximately 1,280 applications and 3,400 code repositories across 27 provincial government ministries. Many of these had never undergone a systematic security review, and the accumulated technical debt was estimated to be in the billions of dollars.
Approximately 50 AI agents were run in parallel across this system, and using Claude Code (a combination of Opus and Sonnet models), 466 million lines of code were scanned in just 20 hours. The ministry estimates that this would have taken about six and a half years if done manually.
For vulnerabilities found, Claude Code generated corrective code, created missing tests, and in some cases, even rebuilt the entire system. A symbolic example cited is the story of a grant application portal, originally written manually in Java about 25 years ago and initially built over five months, which was rebuilt in just four to five days.
Governance Design Based on "Human Approval"
What is technically and organizationally important here is that this entire workflow is not a system where "AI autonomously distributes patches." Multiple reports consistently emphasize the operational rule that all corrective patches are reviewed and approved by state government engineers before deployment.
Furthermore, Alberta has independently developed a specialized suite of Claude-based agents for continuous security reviews. This includes "red team" agents that simulate external attacks, "blue team" agents that assess compliance with international security standards, and additional agents that check code quality and the clarity of public documentation. The specialized agent configuration, tailored to each role, demonstrates that this is designed as a continuous operational system, not just a one-off tool. Each application is reportedly checked against approximately 95 security management items in a single pass.
Asymmetry between AI-driven vulnerability "discovery" and "exploitation"
Another technical point in this case is the current asymmetry between the speed at which AI discovers vulnerabilities and the difficulty of actually exploiting those vulnerabilities. In a previous test conducted by Anthropic, attempts to have Claude actually exploit vulnerabilities it discovered were unsuccessful only twice out of hundreds of attempts.
In other words, currently, the situation is asymmetrical: "AI-based vulnerability detection and remediation (defense)" is far closer to practical application than "AI-based vulnerability exploitation (attack)." However, Anthropic itself frankly states that there is no guarantee this advantage will last, and the gap in detection and exploitation capabilities may narrow in the future. The significance of the defense side actively adopting this technology now lies in utilizing the time available to prepare while this asymmetry persists.
The Option of Information Disclosure
Alberta has released over 21 technology papers (known as Velocity Papers) as open source regarding this initiative, allowing other government agencies to take a similar approach. Minister of Technology and Innovation, Nate Glubish, described this initiative as "responsible government in the age of AI" and commented that he welcomes opportunities for collaboration with other governments.
Points to Note for Researchers
This is a case study published by Anthropic itself, and information such as the audit results by an independent third party, details of the false-positive rate, and the breakdown of vulnerability severity cannot be fully verified based on the currently available information. While the publication of the technical white paper is commendable from a transparency standpoint, the extent to which this approach is reproducible and its accuracy will likely be determined through further testing and verification by other government agencies and independent researchers.
Nevertheless, the fact that AI agent-based code auditing technology is moving beyond the realm of pilot projects and beginning to be incorporated into the operation of critical public infrastructure is a noteworthy development that indicates steady progress in the implementation phase of this field.