AWS just made its security platform a lot harder to ignore. On August 5, the company announced that Continuum, its code-vulnerability scanner, is being wired directly into the tools developers actually write code in: Anthropic's Claude Code, OpenAI's Codex, and Kiro, AWS's own agentic development environment.
The pitch is simple. You no longer need to leave your editor, run a separate scan, and sift through a wall of findings. Instead, security checks happen where the code is being written, and the results come back ranked by what actually matters in your environment.
What the new integrations actually do
Chet Kapoor, AWS vice president of search, security, and observability, announced the partnerships in a blog post built around a sharp observation: frontier models have gotten good enough at spotting flaws that the bottleneck has moved to the machinery around the model. AWS calls its version of that machinery an agent-team loop, an orchestration layer that picks the best model for each task and holds the connections into your accounts.
Here is how the flow works in practice:
- You trigger a security scan from inside Claude Code, Codex, or Kiro, without leaving the editor.
- Findings travel back to Continuum, which ranks them against the rest of your environment before recommending anything.
- Continuum reads your account configurations, IAM policies, network topology, and internet exposure before deciding a finding deserves your attention.
- For anything that looks real, the service builds a working exploit in a sandbox to confirm the vulnerability, which is how it culls false positives.
That last step is worth reading twice. A tool that proves a vulnerability is exploitable before telling you about it is the difference between a useful alert and another notification you ignore.
The ranking logic also respects context. A bug in code that never reaches production ranks below one sitting on a public path. The same finding that would be urgent in one project might be routine in another, and Continuum is built to know the difference.
What this means for your security workflow
AWS described two ways to use Continuum. On existing code, it works through what is already deployed, hunting for flaws in the software you run today. On new code, it feeds security-checked suggestions in while the code is still being written, which is where fixing a bug is cheapest.
Enterprises are already paying attention. Mike Johnson, chief information security officer at Rivian, said in the announcement that Continuum connects source code with enterprise knowledge, letting teams pinpoint security vulnerabilities and verify that flagged issues are truly meaningful. His summary: it shortens the timeline to fix serious vulnerabilities, which is the metric that actually matters.
For developers, the practical takeaway is to treat this as a review layer that works with your agentic tools rather than against them. Continuum is model agnostic. AWS calls on whichever frontier model performs best at a given stage and has pointed to Anthropic's Claude Mythos as an example of a model that can reason through attack paths without being walked there.
The ecosystem is already extending the platform. Skyhawk Security said in late July that it was feeding Continuum findings into simulated attacks against digital twins of customer cloud environments, ranking flaws by whether an attacker could actually weaponize them. Continuum itself launched at AWS Summit New York on June 17, so the integrations are arriving just weeks after the platform went public.
When you can try it
There is one catch: AWS Continuum for code vulnerabilities remains in gated preview and requires a request for access. AWS gave no date for the Claude Code, Codex, and Kiro integrations beyond saying they are coming soon.
If you want to be ready, the practical move is to request access now, then map out which repositories would benefit most from ranked, exploit-verified findings once the integrations land. The tooling is arriving at a moment when the industry is shifting from asking whether AI can find bugs to asking how to act on what it finds.
Comments