Since 2025, the Government of Alberta has been using Claude Code with both Opus and Sonnet models to review its systems, find vulnerabilities and fix them. A team inside Alberta's Ministry of Technology and Innovation scanned 466 million lines of code in 20 hours, a review the team estimates could otherwise have taken around 6.5 years.
"By using AI to find and fix vulnerabilities across our systems, we accomplished in hours what would have taken a traditional approach years to complete," said Nate Glubish, Alberta's Minister of Technology and Innovation.
The Ministry maintains the systems of all 27 provincial ministries, from social services to public safety to wildfire response, including roughly 1,280 applications and 3,400 code repositories. Most of it has never undergone a systematic security review, and the accumulated technical debt runs into the billions of dollars. The systems hold sensitive information including tax records, government procurement data and social services case files. In 2025 the Ministry set up an internal team to make these systems more secure and easier to maintain over time.
Around 50 agents worked autonomously and in parallel to scan for security vulnerabilities, weaknesses in infrastructure and deployment processes, and gaps in technical documentation. Claude Code ran a two-stage routine, first scanning each repository with a rules engine to flag known patterns, then reviewing those flags and citing the exact file and line for each finding. The scan covered every repository Alberta owns and found issues that traditional automated scanning tools had missed.
Where a vulnerability was found, Claude Code could often generate a fix, test it and build it, writing tests first where a system lacked them. Some systems could be rebuilt in as little as four to five days, including a subsidy program portal originally hand-coded in Java roughly 25 years ago that took five months to build the first time. Every patch was reviewed and approved by the Ministry's engineers before shipping.
The cybersecurity team also built specialized review agents on the Claude Agent SDK. A "red team" agent probes an application from the outside, and a "blue team" agent assesses its defenses against an international security standard and writes a remediation plan. Every application is checked against roughly 95 security controls on each pass.
Alberta plans to use Claude Code to consolidate one ministry's 185 legacy applications into 16 reusable applications, and this fall it will begin a program to scale its approach across the provincial government.