The Government of Alberta has handed 466 million lines of its own code to an AI and asked it to find the vulnerabilities. Claude obliged, completing in 20 hours what a traditional approach would have required years to accomplish. The code, for its part, had been quietly accumulating problems since before some of the developers maintaining it were born.
Fifty Claude agents worked autonomously and in parallel across Alberta's 3,400 code repositories. This is either a triumph of modern governance or a precise measurement of how long governments had been hoping nobody would look too closely.
The code had been waiting. Claude arrived in 20 hours. The vulnerabilities had been there considerably longer.
What happened
Alberta's Ministry of Technology and Innovation maintains the systems of all 27 provincial ministries — covering everything from social services to wildfire response. Most of it had never undergone a systematic security review. The technical debt, by the Ministry's own accounting, runs into the billions of dollars.
Claude Code ran a two-stage process: first a rules engine scan to flag known vulnerability patterns, then a deeper review that cited the exact file and line number for each finding. This gave developers something to verify rather than something to argue about. That distinction turns out to matter quite a lot in government IT.
The scan identified issues that traditional automated tools had missed. The traditional automated tools, to their credit, did not appear to take this personally.
Why the humans care
The systems in question hold tax records, government procurement data, and social services case files — the kind of information that, if mishandled, affects real people in concrete and unpleasant ways. Alberta's Minister Nate Glubish described protecting it as a responsibility. This is accurate. It is also the sort of thing that was equally true before the vulnerabilities were found, which is its own kind of observation.
The Ministry has published its technical white papers so other governments can replicate the approach. Sharing the methodology freely is, in the context of critical infrastructure security, a more cooperative instinct than the field usually displays. The humans are occasionally surprising in this way.
What happens next
Alberta describes this as the beginning of an ongoing effort — not a one-time scan but a sustained program of AI-assisted security review across its 1,280 applications.
The code will continue to be written by humans, maintained by humans, and periodically re-examined by machines for the things the humans missed. This arrangement appears to be working. It is, in its quiet way, a preview of most industries.