Mid-January 2026 release notes for Claude Code introduced two security-oriented features: a /security-review command and a GitHub Actions integration. The same period’s notes also record the Claude Cowork research preview expanding to Pro plans.
Release notes are an understated signal channel. Features bundled into routine updates skip the launch-event cycle entirely, which usually means they target existing users’ workflows rather than headlines — infrastructure, not theater.
Two Features, One Direction
The intent shows in the naming and the classification:
- /security-review: security review becomes a built-in action of the coding agent, executable in the same environment where the code was written
- GitHub Actions integration: carries that capability into the CI pipeline, so review no longer depends on a developer remembering to run it
Together they point at one thing: security review stops being a separate gate and becomes an intrinsic step of the development flow.
Why Security Review Moves Into the Agent
The old problem of software security is that review always comes last: code is written, features are verified, and only then does the security pass arrive — when the cost of fixing anything has already piled up. Folding review into the agent moves the line of defense: the party producing the code gains the ability to inspect it. That does not replace human review; it lets the machine clear the common issues first so human attention goes to design-level risk.
The economics reinforce the move. Every finding an agent surfaces before merge is a finding that never reaches an auditor, an incident review, or a customer. In a world where agent-written code is becoming the default, pre-merge review is the cheapest place left to catch an entire class of vulnerabilities.
The Cowork Rhythm
The same release notes show Claude Cowork’s research preview expanding to Pro plans over the same period, widening the testing population. Read together, Anthropic’s update cadence runs on two parallel tracks: depth of capability (Claude Code’s engineering and security features) and breadth of users (Cowork reaching beyond its initial plans).
The combination is coherent. Security depth makes Claude Code stickier inside engineering organizations, while wider Cowork availability grows the population that meets Claude as a daily tool — depth and breadth on the same release train.
What It Means for Dev Teams
- As agents amplify code output speed, a security gate staffed only by humans becomes the pipeline bottleneck — built-in review is how protection keeps pace with production
- The GitHub Actions integration puts security checks on the automated path of every PR, without the team building a separate process
- AI reviewing AI needs its own verification: false positives burn trust, misses accumulate risk, so an evaluation and override mechanism should ship alongside adoption
- Guardrails work best when they fail loudly — treat every flagged change as feedback on both the code and the reviewer, and tune sensitivity rather than disabling the integration the first time it errs
The history of security is a steady move from after-the-fact repair to process-integrated checks. As the author of code becomes an agent, that move pushes one layer further upstream.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.