How Old and Messy Was This Code

Alberta's Ministry of Technology and Innovation maintains systems for 27 departments across the province — everything from social services to public safety to wildfire response depends on it. Behind that sits roughly 1,280 applications and 3,400 code repositories.

Most of it had never been through a systematic security review. Years of accumulated technical debt — insecure code, unfixed bugs, outdated software — adds up to a rough estimate of billions of dollars. And these are the systems holding the most sensitive information there is: tax records, government procurement data, social services case files.

How Do You Find Problems in 466 Million Lines of Code

About 50 agents worked autonomously in parallel, each scanning a share of the repositories. They looked not just for security vulnerabilities but also weak points in underlying infrastructure and deployment pipelines, and gaps in technical documentation.

The rules engine here is a set of pre-written mechanical matching rules: any code that fits a certain shape gets flagged. It only flags — it doesn't judge whether something is a real problem.

This single pass covered every code repository Alberta owns, and turned up issues that traditional automated scanning tools had missed. It finished in 20 hours; the team estimates traditional manual review at this scale would take roughly 6.5 years.

Once Found, AI Fixes It

Finding the issue is only half the job. Where the scan turns up a vulnerability, Claude Code can often write the patch itself: generating the fix, running tests, completing the build.

When a system lacks automated tests and there's no way to confirm a patch is safe, Claude adds the tests first. When code is too old and too complex for patching in place to be worthwhile, it simply rewrites it in a more modern, more maintainable language. The whole process happens alongside the department's own engineers: every patch goes through human engineer review and approval before it ships.

The clearest illustration of the gap is a subsidy program portal. It was hand-written in Java 25 years ago, and building it originally took a full 5 months. Rewriting it in a modern language this time took as little as 4 to 5 days.

Scanning Isn't the End: Red Team and Blue Team Watch Around the Clock

Scanning the systems and shipping the patches isn't the end of the story. Alberta's cybersecurity team also built a dedicated set of Claude review agents that run continuously throughout the development process — turning security review from a one-off special sweep into a standing checkpoint baked into everyday development.

On every run, each application is checked item by item against roughly 95 security controls. These 95 items are specific checks broken out from international security standards — things like whether passwords are stored encrypted, whether user input is validated. Together they form a 95-item security checklist that gets run through from the top every single round.

Besides the red and blue teams, there are also agents dedicated to checking code quality and whether the text the public sees is clear. This entire suite of review agents is built on the Claude Agent SDK.

Can Other Governments Copy This Playbook

Alberta has no intention of keeping this playbook to itself. It has already written up the entire process as a set of technical white papers, published openly for other provinces, states, and federal governments to reference — because technical debt and security vulnerabilities are headaches every government system in the world shares.

Next, Alberta plans to have AI agents do more than fix code — working alongside engineers to build entirely new software and tools from scratch. For instance, one department has 185 legacy applications still running in production, expensive to maintain and hard to update; the team plans to use Claude Code to map them out and consolidate them into 16 reusable, modern-language applications.

At the same time, Alberta is also training government employees and the general public on how to use AI through the "Alberta AI Academy" — teaching everything from writing prompts to shipping enterprise-grade applications.

The Numbers Speak

Putting the most striking numbers in this piece side by side: the same job, two very different timescales.

Starting in 2025, the ministry handed the job to Claude Code (Anthropic's AI coding tool): about 50 AI agents (AI programs that can plan their own steps and do the work) worked autonomously in parallel, all at once, and scanned all 466 million lines of code in 20 hours. It didn't just find vulnerabilities — it could fix them too.

But with dozens of agents and hundreds of millions of lines of code, how do you make sure what gets flagged is a real vulnerability and not a pile of false positives? The answer is in the diagram below.

The key is a two-stage pipeline: machines do a rough first pass, then Claude does the fine sorting; whatever issues get flagged, AI fixes next, and after that a red team / blue team keep cycling through checks every day.

The rules engine here is a set of mechanical matching rules — "flag it if the code looks a certain way." It only flags, it doesn't judge whether something's real, much like an airport metal detector: the alarm goes off, the person gets stopped, and the finer check downstream decides what's real. Red team/blue team are two AI groups, one attacking and one defending: one plays hacker to find vulnerabilities, the other patches defenses against international security standards and writes out exactly which file to change. Every round, each application has to clear roughly 95 security controls (a 95-item security checklist).

"Over 2,800 times faster" doesn't mean much on its own — but convert it to time and it lands. Same 466-million-line security review, here's how long each approach takes: