The Government of Alberta, Canada, has revealed that it used Anthropic's Claude Code to run a security audit across its entire portfolio of government systems. Around 50 AI agents worked in parallel to scan 466 million lines of code in just 20 hours, uncovering vulnerabilities and moving on to fixes and even rebuilds of legacy systems[1]. Few governments anywhere have taken AI this deep into their infrastructure, and the project could serve as a blueprint for others.

466 Million Lines Reviewed in 20 Hours

Alberta's Ministry of Technology and Innovation maintains the systems of all 27 provincial ministries, spanning roughly 1,280 applications and 3,400 code repositories. These systems hold highly sensitive information such as tax records, government procurement data, and social services case files, yet much of the code is old and had never undergone a systematic security review[1].

Starting in 2025, the ministry began a full inspection using Claude Code with both Claude Opus and Sonnet models. About 50 agents worked autonomously and in parallel, running a two-stage routine: a rules engine first flagged known patterns, then Claude reviewed those flags and cited the exact file and line for each finding. The scan covered every repository the province owns and took about 20 hours—work the team estimates would otherwise have taken around 6.5 years—and it identified issues that traditional automated scanning tools had missed[1].

Nate Glubish, Alberta's Minister of Technology and Innovation, said that Albertans trust their government with some of the most sensitive information in their lives, and that by using AI to find and fix vulnerabilities, the province accomplished in hours what would have taken a traditional approach years to complete[1].

From Detection to Fixes—and Full Rebuilds

For many of the vulnerabilities the scan uncovered, Claude Code could generate a fix, test it, and build it. Where a system lacked the automated tests needed to confirm a patch was safe, Claude wrote the tests first. Code that was too outdated or too complex to patch efficiently was rebuilt in a more modern and maintainable language. In one case, a subsidy program portal originally hand-coded in Java roughly 25 years ago—which took 5 months to build the first time—was rebuilt in as little as 4 to 5 days[1].

That said, the process is not fully automated. Before any patch ships, it is reviewed and approved by the ministry's engineers, keeping a human check in the loop[1].

Red Team and Blue Team AI Agents on Constant Patrol

Alberta's cybersecurity team also built a set of specialized Claude review agents that run throughout the development process. A "red team" agent probes an application from the outside, the way an attacker might, and maps how a vulnerability could be exploited. A "blue team" agent then assesses the application's defenses against an international security standard and writes a remediation plan pointing to the exact files to fix. Additional agents check code quality and the clarity of public-facing writing. Every application is checked against roughly 95 security controls on each pass, with all of these agents built on the Claude Agent SDK[1].

The province is investing in people as well. Through the Alberta AI Academy, thousands of government employees and more than 10,000 members of the public have learned the essentials of effective AI use. Next up is a plan to analyze one ministry's 185 legacy applications and consolidate them into 16 reusable, modern applications[1].

Summary

The Government of Alberta completed a 466-million-line code audit in 20 hours with Claude Code and is pushing ahead with AI-driven fixes and legacy system rebuilds. The province has published technical white papers documenting the effort and will host an industry day in Edmonton in July to share what it has learned[1]. With aging systems and technical debt weighing on governments worldwide, it will be worth watching whether this AI-powered cleanup of public infrastructure spreads to other countries and municipalities.

Source: https://www.anthropic.com/news/alberta-government-claude-cybersecurity