Alberta Government Audits 466 Million Lines of Code in 20 Hours with Claude

The Government of Alberta, Canada, has used Anthropic’s Claude to run a security audit and remediation across all of its provincial systems, in a case study Anthropic published on July 6, 2026¹. Around 50 AI agents worked in parallel to scan 466 million lines of code in just 20 hours - a job that would have taken roughly 6.5 years with traditional methods¹.

Alberta’s Ministry of Technology and Innovation maintains the systems of all 27 provincial ministries, spanning everything from social services to public safety to wildfire response. That footprint covers roughly 1,280 applications and 3,400 code repositories¹. Since 2025, the province has been using Claude Code with both Opus and Sonnet models to review its systems and find and fix vulnerabilities¹.

50 Agents Scanning in Two Stages

In the scan, around 50 agents operated autonomously and in parallel¹. Claude Code ran a two-stage routine: it first scanned each repository with a rules engine to flag known patterns, then reviewed each flag and cited the exact file and line so developers could verify every finding¹.

The scan identified issues that traditional automated scanning tools had missed¹. The agents also handled much of the follow-up: in many cases Claude could generate a fix, test it, and build it, and where older code lacked automated tests, it wrote the tests first¹. When code was too outdated to be worth patching, Claude rebuilt it in a more modern and maintainable language¹.

”Red Team” and “Blue Team” Agents Embedded in the Development Process

Going beyond a one-off scan, the province’s cybersecurity team used the Claude Agent SDK to build a set of specialized review agents that run throughout the development process¹. A “red team” agent probes an application from the outside the way an attacker might, mapping how a vulnerability could be exploited. A “blue team” agent assesses the application’s defenses against an international security standard and writes a remediation plan that points to the exact files to fix¹. These agents check roughly 95 security controls on each pass¹.

The scale of the threat facing the province helps explain why it keeps these AI agents on permanent defense duty: according to the government’s announcement, Alberta blocks more than 189 million attempted connections every day². “Albertans trust their government with some of the most sensitive information in their lives, and it is our responsibility to protect it,” said Nate Glubish, Alberta’s Minister of Technology and Innovation¹.

A 25-Year-Old Portal Rebuilt in 4-5 Days, and 165 Systems Consolidating into 16

The province is also modernizing the legacy systems surfaced by the audit. A subsidy program portal originally hand-coded in Java roughly 25 years ago - which took five months to build the first time - was rebuilt in as little as four to five days¹.

In a media release issued the same day, the provincial government said it plans to replace 165 separate systems with 16 new applications². Against an estimated $2 billion cost of doing the upgrades the traditional way, it expects AI to deliver 95% cost savings². “Alberta spent decades building technology that worked for government. Now we are rebuilding it to work better for Albertans and doing it faster and for far less,” Glubish said².

Publishing the Playbook and Training the Public

Alberta has published what it learned as 21 open-source technical papers known as the “Velocity White Papers,” so other governments can draw on its approach¹². It also launched the Alberta AI Academy education platform in September 2025; thousands of government employees and more than 10,000 members of the public have used it to learn the essentials of effective AI use, from prompting through enterprise application delivery¹².

While much government AI adoption stops at personal productivity - chatbots and document drafting - this case stands out for running code audits and legacy modernization at the scale of hundreds of millions of lines with agents, and for publishing concrete time and cost figures. With the policy environment around AI and cybersecurity in motion - the US lifted export controls on Claude Fable 5 on July 1 - Alberta’s work is likely to be cited as a practical example of AI on the defensive side. For companies and local governments sitting on large legacy codebases, it also offers a concrete reference point for deciding how much of the audit, remediation, and rebuild pipeline can be delegated to AI.

Technical details are available in Anthropic’s case study and in the white papers Alberta has published.