Since 2025, the Government of Alberta has employed Claude Code, utilizing both Opus and Sonnet models, to audit its systems, identify vulnerabilities, and resolve them. An internal team within Alberta's Ministry of Technology and Innovation analyzed 466 million lines of code in just 20 hours, addressed security gaps throughout its infrastructure, and developed new tools to strengthen system safety.
Anthropic is sharing the details of Alberta's experience as an illustration of how government agencies can deploy Claude and Claude Code to secure their infrastructure at scale. This represents a crucial challenge, since governments depend on these systems to deliver benefits and maintain services-yet the underlying code is frequently outdated, insecure, and poorly documented. Alberta has also released a series of technical white papers chronicling its work for other governments to reference; they are available here.
"Albertans trust their government with some of the most sensitive information in their lives, and it is our responsibility to protect it," said Nate Glubish, Alberta's Minister of Technology and Innovation. "By using AI to find and fix vulnerabilities across our systems, we accomplished in hours what would have taken a traditional approach years to complete. This is what responsible government looks like in the AI era, and the best is still ahead of us."
Alberta's Approach
Alberta's Ministry of Technology and Innovation oversees the systems of all 27 provincial ministries, spanning social services, public safety, and wildfire response. This encompasses roughly 1,280 applications and 3,400 code repositories. The vast majority has never been subjected to a systematic security audit, and the accumulated technical debt-insecure code, unresolved bugs, outdated software-amounts to billions of dollars.
The Ministry's systems contain highly sensitive data, including tax records, government procurement information, and social services case files. In 2025, the Ministry established an internal team tasked with making these systems more secure and maintainable over time, leveraging Claude in that effort.
To date, the Ministry has used Claude to:
Evaluate 466 million lines of government code in 20 hours. The team deployed Claude Code with Claude Opus and Sonnet models against the codebases it manages. Approximately 50 agents operated autonomously and concurrently to scan for security vulnerabilities, weaknesses in underlying infrastructure and deployment processes, and gaps in technical documentation. Claude Code executed a two-stage workflow, first scanning each repository with a rules engine to flag known patterns, then reviewing those flags and citing the precise file and line number for each finding so developers could verify them. The scan covered every repository Alberta maintains and surfaced issues that conventional automated scanning tools had overlooked. The process took roughly 20 hours for Alberta's implementation; the team estimates an equivalent manual review could have taken approximately 6.5 years.
Remediate the vulnerabilities the scan uncovered. When the scan identified a vulnerability, Claude Code could frequently generate a fix, test it, and build it. In instances where a system lacked the automated tests necessary to confirm a patch was safe, Claude created the tests first. Where the code was too outdated or too complex to patch efficiently in its current form, Claude rebuilt it in a more modern and maintainable language. In some cases, these systems could be reconstructed in as few as four to five days, including a subsidy program portal originally hand-coded in Java roughly 25 years ago that took five months to build initially. All of this was conducted in collaboration with the Ministry's engineers: every patch was reviewed and approved by the team before deployment.
Conduct continuous security review. Alberta's cybersecurity team also created a set of specialized Claude review agents that operate throughout the development lifecycle. A "red team" agent probes an application externally, simulating an attacker's approach, and maps how a vulnerability could be exploited. A "blue team" agent then evaluates the application's defenses against an international security standard and produces a remediation plan identifying the exact files to fix. Additional agents assess code quality and the clarity of public-facing content. Every application is checked against roughly 95 security controls on each pass. These agents are built on the Claude Agent SDK and execute a comprehensive series of checks and analyses for every application.
Beyond scanning, securing, and modernizing its own systems, Alberta is training both government employees and the public in AI usage through the Alberta AI Academy. Thousands of government workers and over 10,000 members of the public have used the platform to learn the fundamentals of effective AI use, from prompting through enterprise application delivery. Through the Academy, the Ministry of Technology and Innovation aims to extend its methodology beyond a single team or project to every ministry that requires it.
Looking Ahead
Currently, Claude assists the Ministry in writing, reviewing, and deploying code that supports its modernization initiatives. The next phase involves expanding that work with AI agents capable of building entirely new software and tools alongside engineers.
The Government of Alberta also intends to continue its modernization program. One ministry, for instance, has 185 legacy applications running in production that are costly to maintain and difficult to update. The Government plans to use Claude Code to analyze these systems, understand their functions, and consolidate them into 16 reusable applications built on modern coding languages and conventions. The objective is to reduce complexity, lower maintenance costs, and accelerate modernization work that would otherwise require years to complete.
A Case Study for Governments
The technical debt and security vulnerabilities that the Government of Alberta is working to address are far from unique. They exist in the systems of many provinces, states, and federal agencies worldwide. The technical white papers Alberta has published provide other governments with a blueprint for tackling these same challenges.
In addition to the white papers, Alberta is hosting an industry day in Edmonton in July to share its learnings. This fall, it will launch a program to scale its approach across the provincial government. Anthropic will continue working with Alberta as it expands these efforts, and hopes the approach Alberta has documented can help other governments secure their own systems.