Using Claude and ChatGPT for security audits and red teaming: what works

Most 20 to 200 person companies have no security engineer on staff. Code gets written by developers, contractors and now coding agents, and nobody has time to read all of it with a hostile eye. AI models can do a decent first pass at that reading, and they are being sold as more than that. This guide covers what works, what does not, and the rules that keep the work defensive: reviewing your own code, configurations and AI features, with authorization.

Can Claude and ChatGPT do a security audit?

They can do part of one. Use them as a fast, cheap first reviewer that reads code and configuration, explains what looks risky and proposes fixes. Do not use them as the only reviewer, and do not treat their silence as a clean bill of health.

What are these models good at, and where do they fail?

They read code the way a patient junior reviewer does, and they share that reviewer's blind spots.

Where they help

• Common flaws. Anthropic's command reference describes /security-review as analyzing the diff between your branch and the default branch for risks like injection, authentication issues and data exposure.
• Explanation. A model can tell a manager in plain language why a finding matters and what the fix involves, which speeds up decisions.
• Threat model drafts. Both Anthropic's and OpenAI's scanners start by building a threat model of the project, and a chat model can draft one from your design notes.
• Scanner triage. Feed sanitized findings from Semgrep, CodeQL or a dependency tool and ask for groupings and likely false positives.
• Configuration review. Paste a redacted IAM policy or storage configuration and ask what is broader than it needs to be.

Where they fail

• False positives. Anthropic's own GitHub Action includes a false-positive filter and warns that running it on every commit may increase false positives. Treat every finding as a lead.
• Business rules. A model does not know that a manager must not approve their own expense unless someone tells it. An AI review can only check rules it has been given, and yours live in your heads and documents.
• Inconsistency. Anthropic's plugin documentation notes that scans are nondeterministic: two scans of the same code can surface different findings. One clean run proves little.
• False confidence. A fluent explanation of a wrong finding reads the same as a right one.
• Attacks on the reviewer. The Claude Code security review Action states that it is not hardened against prompt injection and should only review trusted pull requests. A hostile contributor can write instructions into code or comments.
• Data exposure. Whatever you paste leaves your environment. That risk is covered in the rules below.

Illustrative example: Consider a developer at a 50-person company who pastes a configuration file into a chat window and asks, "Is this secure?" The file contains a live database password. The model correctly flags the wide-open network rule but cannot un-see the password, and the developer now has a credential to rotate and a record to explain to the security officer. Pasting a redacted copy would have produced the same advice.

Which Claude and ChatGPT security tools exist as of October 2026?

Both vendors have moved from chat advice to dedicated tools. Names and availability have changed several times this year, so check the vendor pages before you plan.

Anthropic.

• /security-review is a command in Claude Code that runs one pass over the changes on your current branch.
• The GitHub Action (anthropics/claude-code-security-review) comments on pull requests with findings, severity and remediation guidance. It needs an API key and, as noted, should be limited to trusted pull requests.
• The Claude Security plugin installs in Claude Code and runs a multi-agent scan of a repository or a diff. It maps the architecture, builds a threat model and has independent agents verify each finding before the report. Patches are never applied automatically. Anthropic's documentation says the plugin does not replace your existing source-code security tools.
• Claude Security, the managed product, is in public beta for Claude Enterprise. An announcement dated October 21, 2026 says it now scans continuously as code changes and tracks when findings are fixed. It began in February 2026 as a limited research preview called Claude Code Security.

OpenAI.

• Codex Security is the new name for Aardvark, which OpenAI announced on October 30, 2025 in private beta. OpenAI's page, updated March 6, 2026, says it was built into Codex and released as a research preview. Its documentation describes four forms: a cloud service that scans connected GitHub repositories, a plugin, a command-line tool and an SDK, with the cloud version in research preview.
• OpenAI describes the original design as a threat model, commit scanning, validation in an isolated sandbox, and a patch for human review. OpenAI reports that Aardvark found 92% of known and synthetically introduced vulnerabilities in its own benchmark repositories. That is a vendor figure on a vendor test.

Plan and pricing details on these products change often, so confirm access on the vendors' pages.

How do you red team your own AI features?

Red teaming an AI feature means probing it on purpose, with permission, to find where it can be tricked into leaking data or doing something it should not. Three open-source tools do this:

• promptfoo is, in its own words, a CLI and library for evaluating and red-teaming LLM-based apps. It generates adversarial inputs, runs them through your application and scores the outputs. It is MIT licensed, and the repository now states that promptfoo is part of OpenAI.
• garak is NVIDIA's open-source LLM vulnerability scanner under the Apache 2.0 license. It probes for hallucination, data leakage, prompt injection, misinformation, toxicity and jailbreaks.
• PyRIT is Microsoft's open-source framework for finding risks in generative AI systems. The older Azure repository was archived on March 27, 2026, and the project now lives at microsoft/PyRIT.

Point them at a test copy of your own application, with test data. The value comes from running them before launch and on every major change, which is the habit described in testing AI before production.

Three frameworks give your findings a shared vocabulary:

• OWASP Top 10 for LLM Applications (2025) lists prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption.
• MITRE ATLAS is MITRE's knowledge base of adversary techniques against AI systems.
• NIST AI Risk Management Framework was released on January 26, 2023 for voluntary use, with a Generative AI Profile (NIST-AI-600-1) published on July 26, 2024. NIST says the framework is being revised.

Which tools are worth connecting through MCP?

The Model Context Protocol (MCP) lets Claude or ChatGPT call external tools, such as reading alerts from your code host. Connect few of them. Anthropic's security documentation says it reviews connectors against listing criteria but does not security-audit any MCP server, so each connection is trust you extend.

CodeQL needs no connector to be useful. It runs queries over a database built from your code and shows results as code scanning alerts in GitHub, which the GitHub MCP server can then read.

What rules keep this safe?

1. Test only what you own or are authorized to test. Written permission covers vendors' systems, customer environments and anything hosted by someone else.
2. Keep secrets and regulated data out of prompts. Do not paste passwords, API keys, private keys, customer records, personal data, health or payment data, or source code you hold under a confidentiality agreement. Redact first, and use an enterprise plan with data terms your lawyer has read. The wider policy is in our guide to AI data security and governance.
3. Have a person confirm every finding. Reproduce it, check that it is reachable, and set the severity yourself.
4. Keep deterministic scanners running. Semgrep and CodeQL give consistent results. Use the model for reasoning and explanation and the scanner for repeatable coverage.
5. Limit what the agent can do. Use read-only access, a sandbox or a separate checkout, and apply one fix per pull request.
6. Hire a penetration tester for anything regulated. Payment, health, financial and government work call for an independent assessment that an auditor or customer will accept. An AI pass is a useful input to it.
7. Write down what was tested. Record the tool, version, date, scope and who reviewed the result.

How Kastling approaches this

Kastling would begin with what the system holds and who depends on it, because that sets how much review it needs. For an AI feature, the team would map what data and tools the feature can reach, agree a test plan with a named owner, and run red-teaming tools against a test copy before launch. Findings go to a person who decides what to fix, and the tests are rerun after each change. Where a system is regulated, Kastling would recommend an independent assessment alongside this work. This falls under AI Integration & Automation, with AWS or Azure specialists brought in for cloud configuration.