The Government of Alberta says it used Claude Code to scan 466 million lines of its own government code in about 20 hours, find security vulnerabilities and fix many of them — work its technology ministry estimates would otherwise have taken roughly six and a half years. Anthropic published the details as a case study on 6 July 2026, and Canadian outlets including BetaKit reported the programme independently. It is one of the most concrete public examples yet of AI reviewing code at scale. The honest bottom line: the results are striking but every headline figure is reported by Alberta and Anthropic, not independently audited, and human engineers still approved each fix.
This piece reflects reporting as of July 2026. The figures are self-reported by the Government of Alberta and Anthropic; treat them as claims from interested parties rather than audited results.
What Alberta actually did
Alberta's Ministry of Technology and Innovation maintains the digital systems for all 27 of the province's ministries — social services, public safety, wildfire response and more. According to the case study, that spans roughly 1,280 applications and 3,400 code repositories, much of which had never had a systematic security review. Since 2025 the ministry has used Claude Code, running on Anthropic's Opus and Sonnet models, to change that.
In the headline exercise, around 50 AI agents worked autonomously and in parallel to scan the codebases for security flaws, weak infrastructure and deployment processes, and missing documentation. Claude Code ran a two-stage routine: it first scanned each repository against a rules engine to flag known problem patterns, then reviewed those flags and cited the exact file and line for each finding, so a human developer could check it. Alberta says the scan covered every repository it owns and caught issues that traditional automated tools had missed.
The numbers — and why to read them carefully
The figures are the reason this story travelled, so they deserve scrutiny. Alberta reports scanning 466 million lines of code in about 20 hours, and estimates the same review by conventional means would have taken around 6.5 years. Where the scan found a vulnerability, Claude Code could often generate a fix, test it and build it; where a system lacked the tests needed to confirm a patch was safe, it wrote the tests first.
One example the ministry highlights: a subsidy-programme portal originally hand-coded in Java about 25 years ago, which took five months to build the first time, was rebuilt in a more modern language in as little as four to five days. That is a genuinely large productivity claim — but it is one anecdote, chosen by the parties with an interest in the result, and it involves rebuilding rather than a like-for-like comparison.
None of this makes the numbers false. It means they are best read as what Alberta and Anthropic say happened, corroborated by outlets reporting the same case study, rather than as figures a neutral third party has verified.
The part that does the real work: humans stayed in the loop
The most important detail is easy to skim past. Alberta says every patch was reviewed and approved by the ministry's own engineers before it shipped. AI code review is well known to surface false positives — findings that look like vulnerabilities but are not — so a citation of the exact file and line matters precisely because a person has to confirm each one. The province's minister for technology, Nate Glubish, framed the effort as "what responsible government looks like in the AI era". Read charitably, the model did the exhausting breadth-first work of reading everything; the engineers did the judgement.
What Alberta built to keep it going
Beyond the one-off scan, Alberta says it built a set of specialised Claude review agents that run continuously as code is developed. A "red team" agent probes an application from the outside the way an attacker might; a "blue team" agent then assesses the defences against an international security standard and writes a remediation plan pointing to the exact files to fix. The province says every application is checked against roughly 95 security controls on each pass, with the agents built on Anthropic's Claude Agent SDK. It has also published a set of technical white papers so other governments can copy the approach, and says it has trained thousands of staff and more than 10,000 members of the public through an "Alberta AI Academy".
Why this matters if you are not in Alberta
For a UK reader, the interest is not the province — it is the template. Councils, NHS trusts, universities and mid-sized firms all sit on old, poorly documented code holding sensitive data, and most have never had a full security review because doing one by hand is slow and expensive. Alberta's case is an early, unusually open data point on whether an AI agent can compress that work from years into days.
The sober reading is the useful one. The approach looks real and repeatable, and Alberta deserves credit for publishing its playbook rather than just a press release. But the eye-catching figures come from the two organisations with the most to gain from them; the value depended on engineers checking the AI's output, not on the AI being trusted blindly; and "scanned and flagged" is not the same as "made secure". If your organisation is weighing something similar, the case for trying it is strong — and so is the case for budgeting for the human review that made Alberta's version work.
FAQ
What did Alberta use, exactly?
Claude Code — Anthropic's coding tool — running on its Opus and Sonnet models, with around 50 agents working in parallel, plus custom "red team" and "blue team" review agents built on the Claude Agent SDK.
Did the AI fix the problems on its own?
No. Alberta says Claude Code often generated and tested fixes, but the ministry's engineers reviewed and approved every patch before it went live.
Are the 466 million lines and 20 hours verified?
Not independently. Those figures come from Alberta and Anthropic. Other outlets reported the same case study, but the numbers trace back to the same source rather than to a neutral audit.
Can other governments copy this?
Alberta has published technical white papers describing its approach and plans to scale it across the provincial government this autumn, so the method is at least documented for others to try.
The takeaway
Alberta has given a rare, specific look at what AI code review can do across a real government's systems — hundreds of millions of lines reviewed fast, vulnerabilities found and patched, old software modernised. That is worth paying attention to. It is also a case study written by the tool's maker and the tool's customer, resting on self-reported numbers and, crucially, on human engineers checking the work. The honest lesson is not "AI secured a government"; it is that AI plus disciplined human review covered ground that used to be impractical to cover at all. Copy the discipline, not just the headline.