Amazon Web Services (AWS) will integrate its code vulnerability checking service, AWS Continuum, with AI coding tools from Anthropic and OpenAI. SiliconANGLE reported on Aug. 5 local time.

The integration targets are Anthropic's Claude Code, OpenAI's Codex and AWS's agentic development environment Kiro. Scan results are sent back to Continuum, which compares them against a customer's overall environment to prioritize vulnerabilities and recommend responses.

Continuum also analyses account settings, credential and access management policies, network topology and whether assets are exposed to the internet. It then determines whether an issue is one developers need to check. It rates vulnerabilities on externally exposed paths higher than code bugs that are not deployed to production. It builds working exploits in a sandbox to verify vulnerabilities are real and reduce false positives.

AWS applies Continuum differently to already deployed code and to new code. For deployed code, it checks vulnerabilities based on deployed assets. For new code, it provides suggestions that undergo security verification at the writing stage.

Chet Kapoor (체트 카푸어), AWS vice president for Search, Security and Observability, explained that as frontier models improve at detecting flaws, the bottleneck has shifted from the models themselves to the systems that operate them. AWS calls this structure an "agent team loop". The agent team loop is an orchestration layer that selects the best model for each task and maintains connections to customer accounts.

AWS unveiled Continuum at the New York AWS Summit in June. Continuum is not tied to a specific model and calls the most suitable frontier model at each step.

Skyhawk Security said it has been feeding Continuum detection results into simulated attacks on digital twins of customers' cloud environments since late July. It prioritises issues based on whether attackers can actually exploit the vulnerabilities. AWS Continuum for code vulnerabilities is still in a limited preview stage. Separate requests are required to access it.