Anthropic published a Government of Alberta case study on July 6, 2026. The details are concrete: Alberta's Ministry of Technology and Innovation used Claude Code with Opus and Sonnet models to review government systems, find cybersecurity vulnerabilities, and help fix them. This is not a generic example of AI writing code. It is government-scale legacy system security review.
The headline number is large. The team scanned 466 million lines of code in about 20 hours. Anthropic says Alberta maintains roughly 1,280 applications and 3,400 code repositories across provincial ministries. Those systems handle sensitive information and carry a large technical debt burden. A traditional comprehensive review could have taken years.
Alberta did not hand the whole process to one black-box agent. Around 50 agents worked in parallel. Claude Code first used a rules engine to flag known patterns, then reviewed those flags and cited specific files and lines so developers could verify findings. That design matters because security work needs evidence trails, not only broad recommendations.
The remediation workflow is just as important. When Claude Code identified a vulnerability, it could often generate a fix, write tests, and build the project. In systems without the automated tests needed to validate a patch, Claude wrote tests first. For legacy codebases, that is a major step because the blocker is often not the lack of a possible fix, but the lack of confidence that a fix is safe.
Alberta also built continuous security review agents, including red-team style external probing, blue-team defense assessment, code quality checks, and review of public-facing writing clarity. Each application is checked against roughly 95 security controls on each pass. That shows the value of cybersecurity agents is not only one-time scanning. It is moving review into the development lifecycle.
The broader signal is clear: AI coding agents are moving beyond developer productivity into public-sector systems, critical services, and high-risk maintenance work. Speed alone is not enough. Organizations need evidence trails, human approval, tests, policy controls, and staged deployment. The mature pattern is to let AI accelerate discovery and remediation while engineering teams remain accountable for verification, approval, and delivery.
