Government of Alberta uses Claude to scan 466M lines of code and find cybersecurity vulnerabilities

Title

Government of Alberta uses Claude to scan 466M lines of code and find cybersecurity vulnerabilities

Content

Alberta's Ministry of Technology and Innovation used Anthropic Claude Code (Opus and Sonnet models) to scan 466 million lines of code across 1,280 provincial applications in 20 hours, finding vulnerabilities the team estimates would have taken 6.5 years to surface manually. The early-2026 audit found that 1,280 apps were really doing only about 700 distinct business functions. "By using AI to find and fix vulnerabilities across our systems, we accomplished in hours what would have taken a traditional approach years to complete," said Nate Glubish, Alberta's Minister of Technology and Innovation. Deputy Minister Janak Alford summarized the duplication: "With those pre-built pieces, you can't build your car." Alberta's Ministry runs the digital infrastructure for all 27 provincial ministries, from social services to public safety to wildfire response. The 1,280 applications and 3,400 code repositories hold tax records, procurement data, and social services case files; most had never been through a systematic review, and accumulated technical debt runs into the billions. Alberta set up an internal team in 2025 to make the systems more secure and easier to maintain. The pilot ran earlier in 2026, followed by a public announcement at the Upper Bound conference in Edmonton in May 2026, where Alford demonstrated an agent that had been working 18 of the previous 24 hours on a comparative-law analysis that would have taken 6 to 9 months of consulting work. Alberta published the 21-document "Velocity White Papers" on July 6, 2026, alongside Anthropic's first-party case study. The architecture centers on Claude Code with Opus and Sonnet running on 50 parallel agents. The scan used a two-stage routine: a rules engine first flagged known vulnerability patterns across every repository, then a second-stage review cited the exact file and line for each finding. A "red team" agent probes each application from outside the way an attacker would, and a "blue team" agent assesses defenses against an international security standard and writes a remediation plan. Every application is checked against roughly 95 security controls on each pass, built on the Claude Agent SDK. 466 million lines of code across 1,280 applications and 3,400 repositories were scanned in 20 hours with 50 parallel agents. Alberta estimates AI agents can cut modernization time by as much as 95% and speed delivery by up to 20 times, with conventional modernization of the same systems projected to run $2 billion and take more than a century. A rebuild of the province's subsidy program portal took four to five days, versus the original Java version's five months roughly 25 years ago. Through the parallel Alberta AI Academy, more than 2,000 Alberta public servants have been trained since September 2025. Alberta plans to expand Claude Code use across the province. One ministry has 185 legacy applications that the province plans to consolidate into 16 reusable applications built on modern coding languages and conventions. The Province is hosting an industry day in Edmonton in July 2026 and will scale its approach across the provincial government in fall 2026. The 21 Velocity White Papers are intended as a blueprint for other governments to follow.