Konvu vs Claude Security: Finding Vulnerabilities vs Proving Them (2026)

Quick verdict: Run Claude Security to find vulnerabilities in your own code, and add Konvu when findings from Claude Security, your scanners and your bug bounty program outgrow your team. Konvu proves which findings an attacker can use by running each exploit against its own deployed copy of your application, then ships the fix and re-runs the exploit against it.

Claude Security goes after the business logic and access control flaws that rule-based scanners miss. As of October 13, 2026, its documented verification reads code, and Anthropic ships no dependency (SCA) scanner, so teams with a real backlog usually run both.

The question each one answers

Anthropic says the hard part has moved. From its May 27, 2026 guide, Using LLMs to secure source code: "Our primary takeaway: discovery is now straightforward to parallelize, and the bottleneck has shifted to verification, triage, and patching". Its October 8 Cyber Mission post repeats it: "It’s easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging."

We agree. Detection is solved. The decision is not. More on that in Mythos made finding free.

Claude Security: what is wrong in this code?

Claude Security reads a repository the way a security reviewer would. From the product FAQ: "It can read Git history, trace data flows, and understand business logic to find real vulnerabilities and generate real fixes." Each finding comes with a severity, a confidence rating, written reproduction steps and a recommended fix.

Konvu: which of these findings can an attacker use?

Of everything reported to you by scanners, researchers and AI code security tools, Konvu decides which findings an attacker can use, proves it with a working exploit, and automates the remediation. It takes Claude Security's output as a vulnerability report and hands the fix to Claude Code with the proof attached.

Everything Anthropic offers for security (as of October 13, 2026)

Claude Code Security launched on February 20, 2026 and became Claude Security at its public beta on April 30 (announcement).

An Enterprise beta also checks Claude skills and plugins for malicious behavior. Anthropic offers no dependency (SCA), container or infrastructure-as-code scanning product.

Side by side

How Claude Security decides a finding is real

The hosted product. From the product page: "Every finding goes through an adversarial verification pass." The February 20 launch post explains the confidence rating: "Because these issues often involve nuances that are difficult to assess from source code alone, Claude also provides a confidence rating for each finding."

Severity. The support article bases it on exploitability in your codebase. High means "Exploitable by an unauthenticated remote attacker against a default deployment, with no meaningful preconditions". Whether the hosted scan builds the code or runs a proof of concept is not documented as of October 13, 2026.

The plugin. Its agent prompts are public. Three verifiers review each finding for reachability, impact and defenses, starting from "Default to FALSE_POSITIVE." A finding is real only with "a real attacker-controlled source, a real dangerous operation, and no effective mitigation between them", each tied to a file and line. The verifiers are read-only, and: "If the finding could only be settled by running the code, that is a FALSE_POSITIVE". Severity comes from the code alone: "Rate the access path the code binds; never adjust for a deployment you cannot see."

Reports stay short, and the verification record "is computed in code rather than asserted by the model". The trade-off: a finding only a running application could settle gets ruled a false positive. Settling that kind of finding is what Konvu's lab is for.

/security-review. Its published prompt tells the false-positive check: "You do not need to run commands to reproduce the vulnerability, just read the code".

Anthropic on what code can't show. The May 27 guide: "During static scanning, the model reads code and hypothesizes what might break, but it cannot test if a path is reachable or if there's a compensating control." It quotes a CISO: "[The model has] good context of the code, but not good context of us." Teams it worked with found that requiring a proof of concept "brought the false positive rate to near zero".

Anthropic does run reproducers elsewhere: each OSS Scanner report includes "a self-contained reproducer". That service covers open-source projects only.

Real bugs that weren't exploitable here

False positives are low on reviewed findings. As of October 2, 2026, external security firms had confirmed 5,674 of the 6,123 Anthropic findings they reviewed, 92.7% (Anthropic disclosure ledger). The gap opens later, when someone decides how much a real bug matters in one deployment.

None of these cases went through the Claude Security product. They come from Anthropic's research and disclosure work, and Anthropic deserves credit for publishing them.

Temporal, CVE-2026-5199: critical in the code, 2.3 LOW in the deployment

Claude Mythos Preview found broken access control in Temporal and rated it critical. The finding card: "This finding was identified by static analysis and has not yet been dynamically reproduced." Temporal shipped a fix three days after the report and scored it CVSS 4.0 2.3 LOW (CVE record). The attacker needs a writer role, and "Exploitation requires the attacker to know or guess specific victim workflow ID(s)". It also "requires a server configuration where internal components have cross-namespace authorization".

The bug was real and the fix was right. Roles, guessable IDs and the cluster's deployment decided how much it mattered.

Anthropic's disclosure ledger: maintainers often rate lower

As of October 2, 2026, 166 findings in Anthropic's public ledger carry both Claude's severity and the maintainer's. Maintainers rated 78 lower, 76 the same and 12 higher (Konvu analysis of Anthropic's ledger data; a small, self-selected sample, since maintainers publish a severity only sometimes). Anthropic explains the pattern: "Anthropic's severity assessments are produced before any maintainer input. Project maintainers often apply project-specific severity rules that Claude does not have access to at run time".

Firefox with Opus 4.6: 22 security bugs, 2 exploits

In February 2026, Anthropic sent Mozilla 112 reports found with Claude Opus 4.6, 22 of them security bugs (Anthropic). "Opus 4.6 was only able to actually turn the vulnerability into an exploit in two cases." Those exploits "only worked on our testing environment, which intentionally removed some of the security features found in modern browsers." Anthropic's conclusion: "Claude is much better at finding these bugs than it is at exploiting them."

Anthropic's later model went further. With Mythos Preview, Firefox 150 fixed 271 bugs, 180 of them sec-high (Mozilla). Mozilla still separates a bug from an exploit: "In most cases, a single critical/high bug is not actually enough to compromise Firefox."

curl and Mythos: five "confirmed" vulnerabilities, one LOW CVE

Through Project Glasswing and Alpha-Omega, a third party ran Mythos against curl and reported five "Confirmed security vulnerabilities". Daniel Stenberg, curl's lead developer, wrote on May 11: "we had trimmed the list down and were left with one confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed “just a bug”." The survivor was "a severity low CVE". Same post: "Barely any false positives, so I presume they have had a rather high threshold for certainty."

The report says two findings were reproduced empirically, and curl accepted one, so at least one reproduced finding still wasn't a vulnerability. Running an exploit proves behavior. Konvu's verdict also checks the observed effect against the claimed impact and your program's scope.

What these tools get right

Mythos Preview "fully autonomously identified and then exploited a 17-year-old remote code execution vulnerability in FreeBSD" (Anthropic). These tools find real, serious bugs.

Some teams skip proof on purpose. Mozilla: "We also generally don’t build exploits to see whether a bug could be used by an attacker in the real world." When fixes are cheap, fixing beats proving. Konvu's case is strongest for large backlogs of application and dependency findings, where each fix costs real engineering time.

How Konvu decides

What happens to a report. Claude Security's export reaches Konvu as a vulnerability report (External reports). Konvu splits it into one report per independently fixable finding, triages each against your program's scope and rules, links duplicates, and attacks what passes triage. This runs by default for every report, on the same pipeline as Konvu's bug bounty triage.

The lab. Konvu builds and deploys its own copy of your application and runs nothing against your infrastructure. Labs live in a dedicated AWS account used for nothing else. The application and the attacker run on separate hosts, attacker egress is denied by default, and everything is torn down at the verdict (how we built it). Konvu doesn't see your production WAF or gateway either, so each result lists "Where the lab differs from production" for a person to judge.

The verdict. Konvu breaks each report into claims, checks the observed effect against each one, and marks it proven, disproven or inconclusive. The rollup "follows fixed rules that no model can override" (How reproduction works). Four results (Reading a reproduction):

• Exploitable, shown as Reproduced: the exploit fired and its impact was observed.
• Not exploitable: evidence shows the vulnerability isn't present, with a disproof investigation listing what Konvu checked.
• Hardening: the weakness is real in the code, but a mitigation stops it from being exploited at runtime. Worth fixing, at a lower priority.
• Inconclusive: the lab couldn't settle it, and the result carries the reason, such as an environment limitation.

Anthropic's guide says "failure to produce a working PoC is not proof of a false positive." Konvu's rollup agrees: a precondition the lab can't build makes the run inconclusive, never not exploitable.

Scanner findings. For dependency findings from Snyk, Dependabot, Black Duck and others, Konvu checks four preconditions: the vulnerable dependency is installed, the environment matches, the vulnerable code is reachable, and an attacker controls input that reaches it. Each is Met, Not met or Inconclusive, with evidence (Reading an assessment). Konvu also reproduces scanner SAST and SCA findings in the same lab.

The fix. Konvu automates the remediation: draft PRs that run your tests for scanner SCA and SAST findings (Fix pull requests), and a fix prompt with the proof for Claude Code or Codex on reports. Then it re-runs the exploit against the fix to confirm it no longer fires.

Models. Konvu runs on OpenAI and Anthropic models and benchmarks them continuously to use the best one for each task. The model is one component. The exploitability conditions, the lab and the verdict rules are where the work is (why we don't just use Claude).

One run: Grafana CVE-2024-1313

In CVE-2024-1313, an authenticated user in one Grafana organization can delete another organization's snapshot. Konvu built the affected version, attacked it from a separate host and confirmed it on the first attempt.

That is one run on a simple bug: one endpoint was missing an authorization check. We haven't published an average cost or success rate across vulnerability types (full write-up).

Where Claude Security is stronger

• Finding new bugs in your code. Anthropic's launch post says static analysis "often misses more complex vulnerabilities, like flaws in business logic or broken access control." Claude Security goes after those.
• Mythos 5.1 at token cost. From the FAQ: "You get Mythos-quality vulnerability findings without needing direct access to the model." Any Claude Enterprise customer gets it without Cyber Verification Program vetting.
• Discovery at every stage. security-guidance in the session, /security-review and the plugin on demand, Code Review on the pull request, scheduled scans in Claude Security.
• No platform fee. "Scans are charged at direct token cost only." (support)
• Git host reach. The plugin covers "repositories hosted on GitLab or Bitbucket, or on networks that don’t allow inbound connections" and writes SARIF.
• Published discovery numbers. Pen-testers checked 97 critical and high OSS Scanner findings: 85 met the disclosure bar, 11 were real duplicates and 1 was invalid (Anthropic, self-reported).

Konvu's limits

• Not a scanner. Konvu is not a scanner. It needs findings from Claude Security or another source.
• Bug classes outside the lab. Timing races, hardware-dependent bugs, and chains that need a second system.
• The lab differs from production. No production traffic, WAF, gateway or runtime signals. Paid features, managed cloud services and real credentials end inconclusive.
• No published accuracy benchmark. Every verdict carries its evidence so a person can check it.

Running both

1. Claude Security finds. Scheduled scans on GitHub, or the plugin on GitHub, GitLab or Bitbucket.
2. Export. From the hosted product, export Markdown. From the plugin, take CLAUDE-SECURITY-RESULTS.md or the .sarif file.
3. Konvu imports it as a report. Upload from Triage > Vulnerability reports on Business or Enterprise, or use konvu finding vulnerability-report submit or the API on Enterprise.
4. The fix goes back to Claude Code. For each reproduced finding, Copy fix gives Claude Code a prompt with the vulnerability, the proof and the recommendations (Vulnerability reports).
5. Konvu re-tests the fix. It confirms the exploit no longer fires.
6. Close the loop in Claude Security. Dismiss what Konvu ruled out, with a reason and a link to the Konvu result. "Dismissed findings will not reappear in future scans." (Academy)

Claude Security's reports then sit in one decision record with your Snyk, Semgrep and Wiz findings and your bug bounty reports. If you also run OpenAI's tools, see Konvu vs Codex Security.

Pricing models

Anthropic publishes no per-scan price, and a plugin scan "may use a significant number of tokens". Konvu bills for confident verdicts and fix PRs that land. Inconclusive verdicts and failed fix PRs are free (pricing).

Sources checked

All sources checked on October 13, 2026.

• Anthropic: Claude Security, Public beta post, Use Claude Security, Academy tutorial, Claude Code Security, Plugin docs, Plugin source, Automated security reviews, claude-code-security-review repo, /security-review prompt, security-guidance, Code Review, Ultrareview, Using LLMs to secure code, Cyber Verification Program, Anthropic Cyber Mission, Opt-in OSS Scanner, Defending Code harness, CVD ledger, Ledger data, ANT-2026-DJBBBBPE, Mozilla partnership, Claude Mythos Preview, Cybersecurity solutions, Skill and plugin scanning, Pricing
• Third parties: CVE-2026-5199, Hardening Firefox, Mythos finds a curl vulnerability, Mythos curl report, CVE-2024-1313
• Konvu: Pricing, Guardrails, Bug bounty triage, Integrations, From finding to exploit proof, What is Konvu, External reports, Vulnerability reports, How reproduction works, Reading a reproduction, Reading an assessment, Fix pull requests

Related comparisons

• Konvu vs Codex Security: The same question for OpenAI's code security agent, which validates findings when possible.
• Why can't we just use Claude for this?: Four things a frontier model doesn't give you on vulnerability triage.
• From vulnerability finding to exploit proof: How the reproduction lab builds, attacks and verifies, with the Grafana run in full.
• Mythos made finding free: What Glasswing-scale discovery means for a vulnerability management program.
• Claude Code integration: Konvu's MCP server, CLI and Guardrails inside Claude Code.