Alberta Scanned 466 Million Lines of Code in 20 Hours. The Old Way Took 6.5 Years.

The Government of Alberta used Claude Code to scan 466 million lines of code across its entire software estate — roughly 1,280 applications and 3,400 repositories spanning 27 provincial ministries — in about 20 hours. Anthropic’s case study estimates the same review by traditional means would have taken 6.5 years. Around 50 agents ran in parallel, first scanning each repository with a rules engine for known vulnerability patterns, then reviewing flagged findings and citing the exact file and line so a human developer could verify each one before anything shipped.

The clearest proof point is a subsidy-program portal, hand-coded in Java roughly 25 years ago as a five-month build. Claude Code rebuilt it in four to five days, with every patch reviewed and approved by the Ministry’s own engineers. Alberta also stood up continuous-review agents on the Claude Agent SDK — a “red team” agent that probes live applications like an attacker, a “blue team” agent that checks defenses against an international security standard and drafts remediation plans, and code-quality checks that together run roughly 95 security controls per pass.

That pattern — narrow, autonomous agents running on a schedule instead of a person prompting one task at a time — is exactly what Anthropic’s own guide to agent “loops” describes as the mature end of the curve, past ad hoc prompting and into proactive, scheduled work. It also puts real numbers behind a pitch Accenture and ServiceNow are already selling: a joint offering built on the premise that the cost and complexity of migrating off legacy risk and security platforms — not the underlying technology — is what’s kept enterprises stuck, in a market where the average US data breach now runs $10.22 million. Alberta didn’t buy that pitch; it built the equivalent in-house, and published the hours it took.