Anthropic has transitioned to an AI-native software development lifecycle (SDLC) where Claude authors approximately 80% of merged code, with over half of that volume being merged by the internal "Claude Tag" agent. To manage this exponential increase in deployment velocity and the risks of non-deterministic agents—such as prompt injection and supply-chain poisoning—Anthropic has implemented a multi-layered security strategy. During the planning stage, a Claude Opus-powered Project Security Review (PSR) analyzes design documents against the MITRE ATT&CK framework, leveraging an internal knowledge index for context. To prevent recurring vulnerabilities, security guidelines are encoded directly into CLAUDE.md files, creating a closed-loop system where discovered bugs are used to update agent instructions. Development occurs within remote virtual machines with strict egress allowlisting to contain potential exfiltration from prompt-injected agents. At the CI/CD stage, specialized review agents use RAG to perform targeted, narrow-focus reviews, which has increased the rate of substantive review comments from 16% to 54%. While agents automate tasks like CI/CD failure response and large-scale code migrations, Anthropic maintains human accountability through risk-weighted sampling and strict identity boundaries, ensuring that agents have single-purpose identities with minimal permissions to prevent unauthorized lateral movement.