AWS Continuum Now Secures AI-Generated Code from Codex and Claude Code: Complete Guide to Enterprise AI Code Security in 2026

The way enterprises write software has changed irrevocably. In 2026, industry analysts estimate that more than 60 percent of production code at Fortune 500 companies contains at least one significant block authored by an AI coding agent — whether that is OpenAI Codex, Anthropic Claude Code, Amazon Kiro, or one of their competitors. That shift has delivered enormous productivity gains. It has also introduced a new category of security risk that traditional static analysis tools were never designed to address. AI coding agents do not think about security the way a seasoned engineer does. They optimize for functional correctness, syntactic validity, and satisfying the immediate prompt. The result is a generation of software that works — and that leaks credentials, trusts user input, and pulls phantom dependencies with startling regularity. AWS Continuum, Amazon Web Services’ real-time security scanning platform embedded directly inside AI coding agents, was built to close that gap. Its August 2026 expansion to support OpenAI Codex and Anthropic Claude Code alongside the existing Amazon Kiro integration represents the most consequential moment yet in enterprise AI code security.

What AWS Continuum Is and How It Works

AWS Continuum is not a traditional security scanner bolted onto a CI/CD pipeline. Understanding this distinction is critical because it explains why the product has garnered so much enterprise attention since its initial launch in late 2024. Traditional tools like static application security testing (SAST) scanners, software composition analysis (SCA) platforms, and secret detection engines operate post-hoc: they examine code that has already been written, already been committed, and often already been deployed to a staging environment. By the time a developer sees a finding from one of these tools, the insecure pattern has had hours or days to propagate through pull requests, branch merges, and team reviews.

Continuum operates at a fundamentally different layer. Its core technology is the Agent Security Runtime (ASR), a lightweight process that runs inside the execution environment of an AI coding agent itself. The ASR intercepts the token stream produced by the language model before that stream is rendered as visible code in the developer’s editor or terminal. Each candidate code block is evaluated against Continuum’s policy engine — a combination of deterministic rule sets, a fine-tuned security classifier trained on over 200 million labeled vulnerability instances, and a graph-based data-flow analyzer — before the developer ever sees it. If the candidate code violates a configured policy, Continuum either blocks the suggestion entirely and asks the agent to regenerate, or presents the suggestion with an inline annotation explaining the security concern and offering a remediated alternative.

This architecture means Continuum is a pre-developer security control rather than a post-developer one. The company’s internal research, published alongside the August 2026 announcement, found that developers who receive a secure code suggestion for the first time are approximately 84 percent more likely to use it as-is than developers who receive a standard suggestion and then a separate security alert. The implication is significant: shifting security left all the way into the generative moment, rather than into the review moment, changes developer behavior in a durable way rather than simply creating an alert backlog.

Continuum is deployed as a combination of three components. First, the Continuum Agent Layer — the ASR process that runs inside Codex, Claude Code, or Kiro. Second, the Continuum Policy Service — a managed AWS service that stores your organization’s security policies, receives telemetry from all agents, and maintains a centralized audit trail. Third, the Security Hub Extended integration — a dedicated dashboard layer inside AWS Security Hub that aggregates all AI-generated code findings across every developer in the organization, maps them to OWASP Top 10, CWE identifiers, and your internal risk taxonomy, and feeds them into your existing SIEM and ticketing workflows.

The Agent Security Runtime Architecture

At a technical level, the ASR is implemented as a shared library that AI coding agent vendors integrate using Continuum’s published SDK. For Kiro, Amazon’s own agent, this integration is native and ships as part of the Kiro runtime. For Codex and Claude Code, the integration was finalized through partnerships announced alongside the August 2026 release. The ASR operates as follows:

1. The developer issues a prompt to the AI coding agent, requesting a function, a module, a test, or a fix.
2. The agent’s language model generates candidate tokens internally. Before these tokens are assembled into displayable code, the agent runtime calls the ASR via a local inter-process communication socket.
3. The ASR receives the candidate code block, runs the policy engine evaluation (typically completing in 40–120 milliseconds depending on block size and policy complexity), and returns a verdict: ALLOW, ALLOW_WITH_WARNING, BLOCK_AND_REGENERATE, or BLOCK_AND_ESCALATE.
4. For BLOCK_AND_REGENERATE, the ASR returns a description of the violation and a set of remediation constraints to the agent, which then generates a new candidate. This loop repeats up to a configurable maximum — the default is three attempts before falling back to BLOCK_AND_ESCALATE.
5. All verdicts, policy references, code hashes, and contextual metadata are sent asynchronously to the Continuum Policy Service for logging and aggregation in Security Hub Extended.

The entire flow adds minimal latency to the code generation experience. AWS reports a p99 latency overhead of 180 milliseconds, which developers describe as imperceptible given that AI code generation itself typically takes one to three seconds for a medium-complexity function.

The August 2026 Announcement: Codex, Claude Code, and Kiro

On August 12, 2026, AWS published a joint announcement with OpenAI and Anthropic detailing the general availability of Continuum integration for OpenAI Codex and Anthropic Claude Code. The announcement, delivered at AWS re:Invent Mid-Year in Seattle, positioned the expansion as the foundation of what AWS Chief Security Officer Stephen Schmidt called “the first industry-wide standard for AI code security at the generation layer.”

The timing was not accidental. Three weeks earlier, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had released its Guidance on AI-Assisted Software Development Security, which explicitly recommended that organizations using AI coding agents implement real-time security interception at the generation layer rather than relying solely on pipeline scanning. The CISA document cited a study finding that 34 percent of AI-generated code that passed all CI/CD security checks still contained at least one exploitable vulnerability pattern — a finding that aligned closely with AWS’s own internal research shared with federal partners.

The August announcement covered three distinct integration tracks. The Kiro Native Integration, already in production since Q1 2026, was updated to version 2.0 with improved data-flow analysis and support for the new AI-Specific Vulnerability Taxonomy (ASVT) that AWS co-developed with MITRE. The Codex Integration, released in GA, covers Codex CLI, the Codex API (when used in agentic configurations via the Responses API), and the Codex plugin for VS Code and JetBrains IDEs. The Claude Code Integration covers Claude Code’s terminal agent, the Claude Code SDK, and direct API usage through Anthropic’s Messages API when operating in agentic coding contexts.

Critically, both OpenAI and Anthropic confirmed that the Continuum ASR integration is implemented at the agent runtime layer, not as a post-processing filter. This means Continuum sees and can influence code before the developer does — a technical arrangement that required each company to expose new internal APIs to the Continuum SDK that are not available to third-party developers building on top of their public APIs.

Enterprise response was immediate. Within 48 hours of the announcement, AWS reported over 1,200 enterprise accounts activated Continuum across all three agents. Financial services, healthcare, and defense contractors — sectors with existing AI code governance mandates — led adoption. Enterprise AI Coding Agent Adoption in Regulated Industries 2026

Why AI-Generated Code Demands a Different Security Approach

To understand why Continuum’s approach matters, it is necessary to understand the specific ways AI-generated code fails security reviews — and why those failures are systematically different from the patterns that traditional security tools are designed to catch.

Insecure Defaults and the Functional-First Optimization Problem

Language models are trained on vast corpora of public code. Public code is, on average, not particularly secure. It prioritizes functional correctness, readability, and — crucially — passing the specific tests or satisfying the specific requirements described in its documentation. Security is typically an afterthought in the training data. When a model is asked to “write a function that authenticates users,” it will produce code that authenticates users correctly. It will not, without specific prompting or constraints, produce code that implements rate limiting, uses constant-time string comparison to prevent timing attacks, enforces password complexity rules, or rotates JWT secrets appropriately. These patterns are present in the training data, but they are not the dominant pattern for simple authentication functions because most simple authentication function examples do not include them.

The result is what security researchers call insecure defaults at scale. Each individual AI-generated function may be functionally sound. Aggregated across thousands of functions written by dozens of AI-assisted developers, the organization ends up with a codebase where security hardening is systematically absent at every layer.

Library Hallucination and Dependency Confusion

One of the most dangerous and underappreciated failure modes of AI coding agents is library hallucination — the generation of import statements, package.json entries, or requirements.txt lines that reference packages that do not exist in any legitimate registry. This occurs because language models interpolate from patterns in their training data to produce plausible-sounding package names when they do not have high confidence in the correct name.

The security implication is severe. Attackers actively monitor these hallucinated package names. When a model repeatedly suggests a package like aws-auth-helper-sdk that does not exist on npm, threat actors register that exact name and publish a malicious package. Developers who follow the AI suggestion, run npm install, and proceed without careful review import malware directly into their project. This attack pattern, known as dependency confusion via hallucination, was documented in at least 47 confirmed incidents in 2025, resulting in credential theft, supply chain compromise, and in two cases, ransomware deployment in production environments.

Continuum’s ASR includes a real-time package verification step that checks every suggested dependency against a curated allow-list derived from the major public registries, your organization’s private registry, and a known-malicious package blocklist maintained by the Continuum threat intelligence team. Any hallucinated or unrecognized package name triggers at minimum an ALLOW_WITH_WARNING verdict, and organizations can configure their policies to require explicit human approval for any package not present in their verified dependency inventory.

Outdated API Usage and Silent Deprecation

Language models are trained on data with a cutoff date. Even models with retrieval-augmented generation capabilities that can browse current documentation often default to high-confidence patterns from their training data when operating in fast, agentic coding contexts. This means AI coding agents regularly generate code that uses deprecated API patterns — and deprecated API patterns frequently carry known vulnerabilities.

A canonical example is the Python hashlib.md5() function used for password hashing. This pattern appears millions of times in the training data for models through approximately 2023, because MD5 was acceptable for non-security-sensitive hashing and many older tutorials used it incorrectly for passwords. Contemporary AI agents still generate this pattern in contexts where a developer has asked for “a simple password hashing function.” The pattern is not syntactically wrong. It compiles and runs without errors. It is cryptographically catastrophic.

Continuum’s policy engine includes a continuously-updated Deprecated Security Patterns (DSP) library covering over 4,800 specific API usage patterns across Python, JavaScript/TypeScript, Java, Go, C#, Ruby, and Rust that are either deprecated with security implications or that are commonly misused in security-sensitive contexts. This library is updated weekly and automatically pushed to all active ASR instances via the Continuum Policy Service.

Context-Free Code Generation

Human developers write code with an understanding of the broader system they are building. They know that this service runs behind an internal network, or that this endpoint is public-facing, or that this database contains PII. AI coding agents, unless explicitly given this context in every prompt, operate in a context vacuum. They make the worst-case assumption from a security standpoint: that defaults are fine, that the trust model is unclear, and that the calling environment is permissive.

This is why Continuum includes a Context Profile feature — a per-project or per-repository configuration that declares the security posture, data classification, regulatory requirements, and trust boundaries of the codebase. The ASR incorporates context profile parameters into its policy evaluation, raising the sensitivity of checks for codebases tagged as handling PCI data or operating in internet-facing contexts. Configuring AI Coding Agent Context Profiles for Regulated Workloads

How Continuum Integrates with OpenAI Codex

The Codex integration represents Continuum’s most complex implementation because Codex operates in multiple surfaces — as a CLI tool, as an IDE plugin, and as an API that developers can call directly in their own toolchains. Each surface required a different integration strategy.

Codex CLI Integration

For Codex CLI, the Continuum ASR runs as a sidecar process. When you install the Continuum Codex agent package, the installer registers the ASR process as a system-level daemon. At the CLI level, the integration intercepts the Codex subprocess’s stdout stream before it is rendered to the terminal. This approach does not require Codex to have native knowledge of Continuum — the interception is handled at the process communication layer.

Configuration is managed via a YAML file located at ~/.continuum/codex-config.yaml for per-developer configuration and at the repository level via .continuum/policy-override.yaml for project-specific settings. Enterprise policy inheritance means that individual developer configuration files cannot override organizational policies set in the Continuum Policy Service — they can only add additional restrictions.

A typical CLI session with Continuum active looks like this from the developer’s perspective: the developer issues a Codex prompt, Codex generates a response, and within the normal response time, the rendered code appears in the terminal. If Continuum blocked and regenerated in the background, the developer sees a small indicator — a green shield icon in terminals that support ANSI sequences, or a text prefix [CTS:SECURED] in non-graphical terminals — indicating that security evaluation has been applied. If a warning is present, the code appears with an inline annotation in yellow. If the code was blocked after the maximum regeneration attempts, the developer sees a [CTS:BLOCKED] indicator with the policy violation identifier and a link to the Security Hub Extended finding.

Codex IDE Plugin Integration

In the VS Code and JetBrains implementations of the Codex plugin, the Continuum ASR is loaded as a plugin extension that hooks into the language server protocol lifecycle. Inline suggestions are intercepted before they are pushed to the editor’s ghost text rendering layer. This gives the IDE integration a significant UX advantage over the CLI integration: blocked suggestions can be replaced with a visually distinct “Security Review Required” indicator in the editor gutter, while regenerated secure code appears with a subtle green indicator. Warnings appear as underlined code regions with hover-over explanations, similar to standard lint warnings.

The IDE integration also supports Continuum’s Remediation Diff View, which shows a side-by-side comparison of the originally generated insecure code (for educational purposes) and the regenerated secure code that was actually provided to the developer. Security champions within enterprise teams have found this diff view valuable for training purposes — it shows developers the exact patterns that were caught and how they were corrected, creating a continuous security education feedback loop.

Codex API Integration

For teams using the Codex API directly in agentic automation pipelines, Continuum provides a drop-in proxy endpoint. Instead of calling https://api.openai.com/v1/responses directly, teams route requests through https://continuum-proxy.amazonaws.com/v1/openai/responses. The proxy authenticates with your AWS account, applies your organizational policy, performs the ASR evaluation on responses, and forwards compliant responses to your application. Non-compliant responses are either held for regeneration or returned with a structured security finding payload, depending on your configured policy mode.

This proxy approach means that security enforcement is centrally managed regardless of how Codex is being used — whether by a human developer in the CLI, a CI/CD automation pipeline, or an agentic workflow that is itself generating code as part of a larger autonomous process. Securing Agentic AI Workflows in Enterprise AWS Environments

How Continuum Integrates with Anthropic Claude Code

Claude Code’s integration with Continuum takes a different architectural approach, reflecting the terminal-native design of Anthropic’s coding agent. Claude Code is primarily a terminal application that operates with broad file system access, executing commands, writing files, running tests, and iterating based on results. This autonomous, multi-step execution model creates different security surface area than the suggestion-centric model of Codex.

Terminal-Level Interception

For Claude Code’s terminal agent, Continuum uses a Terminal Security Wrapper (TSW) that launches Claude Code as a subprocess within a monitored execution environment. The TSW does not merely inspect individual code suggestions — it monitors the entire session, tracking file writes, command executions, and network requests made during the Claude Code session. This comprehensive monitoring is possible because Claude Code operates as an autonomous process rather than a suggestion engine, meaning its full execution trace is available to the monitoring layer.

When Claude Code writes a new file or modifies an existing file, the TSW intercepts the write operation, runs the Continuum policy engine against the file content, and either allows the write, allows it with an annotation appended to the file’s metadata store, or blocks it and injects a structured error message into Claude Code’s context window explaining what was wrong and requesting a regeneration. This last capability — injecting security findings directly into Claude Code’s context window — is made possible through Anthropic’s new Agent Security Context (ASC) protocol, which was developed in collaboration with AWS and released as part of the August 2026 announcement.

Pre-Commit Scanning

Claude Code’s typical workflow involves writing multiple files across a session before a developer reviews the results and decides whether to commit. Continuum’s Claude Code integration installs a Continuum Pre-Commit Hook that runs a comprehensive policy sweep across all files modified during the Claude Code session before they are staged for commit. This sweep is more thorough than the real-time per-file scan — it includes cross-file data flow analysis, secrets entropy scanning across all modified files simultaneously, and dependency graph analysis that checks for hallucinated or suspicious packages.

The pre-commit hook integrates with standard git tooling and is configured via the same .continuum/policy-override.yaml file used for Codex. In enterprise environments, the hook can be configured as a required check that developers cannot bypass without submitting a policy exception request through the Security Hub Extended workflow.

Real-Time Feedback in Claude Code Sessions

One of the most interesting aspects of the Claude Code integration is its use of the ASC protocol to provide real-time feedback within the agent’s reasoning process. When Continuum’s ASR catches a security issue during a file write, it does not simply block the write and wait for human intervention. Instead, it injects a structured finding into Claude Code’s context, which Claude Code can then reason about and use to self-correct before the developer is ever prompted.

In practice, this means Claude Code sessions with Continuum active self-remediate the majority of security issues autonomously. AWS’s early access data shows that 71 percent of security findings caught by Continuum during Claude Code sessions were resolved by the agent itself within the same session without any developer intervention. The remaining 29 percent — typically complex architectural security issues or policy conflicts that require human judgment — are surfaced to the developer with a structured explanation and a set of recommended remediation options.

Security Hub Extended: Centralized AI Code Vulnerability Management

Individual developer-level security enforcement is valuable. What makes Continuum strategically powerful for enterprises is its centralized visibility layer — Security Hub Extended. This is a dedicated module within AWS Security Hub that aggregates findings from every Continuum-enabled AI coding agent across every developer in the organization, providing a unified, searchable, filterable view of the organization’s AI code security posture.

Dashboard Architecture and Key Metrics

Security Hub Extended’s primary dashboard presents six key metrics for the AI code security program:

• AI Code Security Score (ACSS): A 0–100 composite score representing the percentage of AI-generated code blocks that passed Continuum evaluation without requiring regeneration, weighted by severity of findings caught.
• Blocked Finding Rate: The percentage of AI coding sessions that produced at least one BLOCK_AND_REGENERATE or BLOCK_AND_ESCALATE verdict, tracked by agent type, programming language, and development team.
• Policy Exception Backlog: The number of open requests from developers who encountered a BLOCK_AND_ESCALATE finding and are awaiting security team review.
• Hallucinated Dependency Detections: The rolling 30-day count of library hallucination events, with the specific hallucinated package names listed so security teams can proactively monitor public registries for opportunistic squatting.
• Vulnerability Class Distribution: A breakdown of finding types across OWASP Top 10 categories and CWE identifiers, showing which vulnerability classes are most commonly generated by AI agents in your environment.
• Mean Time to Secure (MTTS): The average time from initial AI code generation to confirmed-secure code being committed, across all agents and all developers.

Integration with SIEM and Ticketing Systems

Security Hub Extended emits findings as standard AWS Security Hub findings in the ASFF (Amazon Security Finding Format), which means they integrate natively with Amazon EventBridge, AWS Config, and any SIEM that has an existing Security Hub connector — including Splunk, Microsoft Sentinel, IBM QRadar, and Datadog Security Monitoring. For ticketing, pre-built integrations are available for Jira, ServiceNow, and Linear, with a webhook-based generic integration for other systems.

Enterprise security teams can configure finding routing rules that automatically create high-priority tickets for BLOCK_AND_ESCALATE findings involving hardcoded secrets or critical CVSS-scored patterns, while routing lower-severity warnings to a weekly digest rather than individual tickets. This prevents alert fatigue while ensuring that the most dangerous AI code patterns receive immediate human attention. AWS Security Hub Integration Guide for AI-Native Development Teams

What Vulnerabilities Continuum Catches: AI-Specific Patterns

Continuum’s vulnerability detection covers both traditional vulnerability classes and AI-specific patterns that are disproportionately represented in AI-generated code. The following sections cover the major detection categories with specific examples of the patterns Continuum identifies.

SQL Injection

Classic SQL injection via string concatenation remains common in AI-generated code because the training data contains millions of examples of query construction without parameterization. Continuum’s ASR detects not only obvious f"SELECT * FROM users WHERE id = {user_id}" patterns but also multi-step injection patterns where the query is assembled across multiple variable assignments — a pattern that frequently evades regex-based SAST tools.

The AI-specific variant that Continuum uniquely addresses is ORM misconfiguration injection: cases where the AI generates correct parameterized queries using an ORM but also generates an optional raw query fallback path that reintroduces injection risk. These patterns appear because models frequently generate “comprehensive” implementations that include both the clean path and a fallback, without recognizing that the fallback is the one that will be used in production when the ORM path fails.

Cross-Site Scripting (XSS)

In frontend code generated by AI agents, Continuum catches direct HTML injection via innerHTML assignment, dangerous use of dangerouslySetInnerHTML in React without sanitization, and — critically — the AI-specific pattern of context-switching XSS, where the AI generates code that correctly escapes HTML in the primary rendering path but fails to escape the same data when it appears in a secondary context such as a JavaScript event handler attribute or a CSS property value.

Hardcoded Secrets and Credential Patterns

Continuum’s secrets detection goes beyond entropy-based scanning to include Semantic Credential Identification (SCI) — a classifier trained specifically to identify patterns that look like they should be externalized as environment variables or secret manager references but are embedded as string literals. This catches cases where the value itself has low entropy (such as a database name or a fixed OAuth scope string) but the context indicates it is a credential or access control value that should not be hardcoded.

In AI-generated code, hardcoded credentials are particularly common in test harness code and in generated examples. Continuum’s policy engine allows organizations to configure different sensitivity levels for test directories versus production code, but the default enterprise policy flags hardcoded credential patterns everywhere, because test credentials frequently migrate into production code through copy-paste or refactoring operations.

Server-Side Request Forgery (SSRF)

SSRF is dramatically overrepresented in AI-generated backend code because models frequently generate HTTP client calls that accept URLs from user-controlled input without validation. The pattern appears in webhook implementations, URL preview generators, file import features, and any function that makes outbound HTTP requests based on user-provided data. Continuum detects SSRF-vulnerable patterns and suggests remediation that includes URL schema allowlisting, hostname validation against a configurable blocklist that includes cloud metadata endpoints, and redirection following restrictions.

Insecure Deserialization

AI coding agents routinely generate deserialization code using unsafe methods — Python’s pickle.loads() on untrusted data, Java’s native ObjectInputStream without filtering, PHP’s unserialize() on user input. These patterns are common in the training data because they are legitimate and commonly used in trusted contexts, and models do not consistently distinguish between trusted and untrusted data sources when generating deserialization logic.

Path Traversal

In file handling code generated by AI agents, path traversal vulnerabilities appear when the agent correctly handles the happy path (writing or reading a file at the expected location) but fails to sanitize the filename or path components provided by user input. Continuum’s ASR detects path traversal patterns not only in obvious cases but also in cases where path manipulation is indirect — for example, where a filename is used to construct a URL that is then fetched, or where a user-provided key is used to construct a file path inside a archive extraction routine.

Dependency Confusion and Hallucinated Libraries

As discussed earlier, Continuum’s real-time package verification catches both hallucinated package names and dependency confusion patterns where a real package name in a private registry could be overridden by a malicious public package. Every import statement and every dependency declaration in generated code is verified against the Continuum Package Verification Service before the code is allowed to proceed. The verification response includes package age, download count, known CVEs, and a hallucination probability score based on how similar the package name is to known hallucination patterns for the language and context.

Setup and Configuration for Enterprise Teams

Getting Continuum deployed at enterprise scale requires careful planning across four dimensions: AWS account configuration, IAM role setup, agent-specific installation, and policy customization. The following walkthrough covers the essential steps for a production enterprise deployment.

AWS Account Requirements

Continuum requires an active AWS account with Security Hub enabled in at least one region. For multi-region enterprises, Continuum supports an aggregator account model where all findings from all regions are consolidated into a single Security Hub aggregator. The Continuum Policy Service is a regional service, and AWS recommends deploying it in the same region as your primary development infrastructure to minimize latency between the ASR process and policy evaluation calls.

Continuum also requires Amazon Inspector to be enabled, as it uses Inspector’s vulnerability intelligence database as a data source for its dependency scanning capabilities. If your organization is already using Inspector for EC2 and ECR scanning, enabling Continuum does not change your Inspector configuration — it simply adds a new finding type to the Inspector finding feed.

IAM Role Configuration

The Continuum setup process creates three IAM roles. The ContinuumAgentRole is assumed by the ASR process on each developer machine — it has permissions to call the Continuum Policy Service API and to write findings to Security Hub. The ContinuumPolicyAdminRole is assumed by security administrators who configure organizational policies. The ContinuumAuditRole is a read-only role for compliance and audit personnel who need to review finding history without modifying policies.

The ContinuumAgentRole is designed to be assumed via temporary credentials issued through AWS IAM Identity Center (formerly SSO), so that developer machines never hold persistent AWS credentials. This is both a security requirement (persistent credentials on developer machines are themselves a common AI-generated code vulnerability target) and an operational benefit (credential rotation is handled automatically).

Agent-Specific Installation

Installation procedures vary by agent. For Codex CLI, the process is:

npm install -g @aws/continuum-codex-agent
continuum configure --profile enterprise --account-id YOUR_ACCOUNT_ID
continuum codex enable --policy-profile production

For Claude Code, the Continuum Terminal Security Wrapper is installed separately:

pip install continuum-claude-tsw
continuum-claude configure --iam-role arn:aws:iam::ACCOUNT:role/ContinuumAgentRole
continuum-claude enable --pre-commit-hooks --context-injection

For Amazon Kiro, Continuum is enabled directly in the Kiro configuration file at ~/.kiro/config.yaml by setting continuum.enabled: true and providing the Policy Service endpoint. Since Kiro and Continuum are both AWS products, the authentication flow uses the developer’s existing AWS profile without requiring additional configuration.

Policy Customization

The Continuum Policy Service ships with three pre-built policy bundles. The Baseline bundle covers OWASP Top 10 and the most common AI code security patterns — it is the minimum recommended configuration. The Regulated Industries bundle adds PCI DSS, HIPAA, and SOC 2 relevant patterns and sets stricter thresholds for data handling code. The Aggressive bundle blocks any code that uses deprecated cryptographic functions, any use of eval-style dynamic code execution, and requires explicit justification for any non-parameterized database query — even in contexts where injection risk is low.

Organizations can create custom policy bundles using the Continuum Policy DSL, a YAML-based configuration language that supports rule inheritance, conditional logic based on file path patterns and repository tags, and exception workflows for cases where a developer needs to use a pattern that would otherwise be blocked.

Cost Analysis: Pricing Tiers and ROI Calculation

Continuum is priced per active developer per month, with volume discounts that make it economically accessible even for large enterprises. Active developer is defined as a developer who had at least one AI coding agent session evaluated by Continuum during the billing month.

For a 500-developer enterprise on the Enterprise tier, the annual cost is approximately $1,080,000. This sounds significant until positioned against the alternative: the average cost of a data breach caused by an exploited vulnerability in internally developed software was $4.88 million in 2025, according to IBM’s Cost of a Data Breach Report. For an organization deploying AI coding agents at scale, the expected frequency of exploitable vulnerability introduction without a tool like Continuum — based on AWS’s research data — is not negligible. The ROI case is straightforward even before factoring in the cost of remediation work, compliance penalties, and reputational damage that breaches carry.

AWS also offers a consumption-based add-on for the API proxy usage (relevant for teams using Codex or Claude Code APIs in automation pipelines), priced at $0.004 per thousand code blocks evaluated. For most enterprise teams, this adds between $50 and $400 per month in additional charges.

Comparison with Alternatives: Snyk AI, GitHub Advanced Security, Semgrep

Continuum is not the only tool competing in the AI code security space, and a fair enterprise evaluation requires understanding how it compares to the leading alternatives.

Snyk AI, rebranded from Snyk Code in early 2026, is the closest competitor to Continuum in terms of AI-specific security focus. Snyk’s approach differs in that its AI security features operate primarily at the post-suggestion layer — meaning Snyk scans code after the developer has already seen the AI suggestion, rather than before. This is a meaningful distinction for security posture because developers who see a suggestion are psychologically anchored to it; they are more likely to accept an insecure suggestion with a warning than to never receive the suggestion at all. Snyk’s strength lies in its superior open-source vulnerability database and its broader ecosystem of integrations with non-AWS cloud environments, making it a strong choice for multi-cloud organizations with existing Snyk deployments.

GitHub Advanced Security (GHAS) remains the dominant choice for organizations heavily invested in GitHub’s platform, particularly those using GitHub Copilot as their primary AI coding agent. GHAS’s CodeQL engine is extremely powerful for detecting complex vulnerability patterns in existing code, and its integration with Copilot — especially the new Copilot Autofix feature — provides some degree of inline remediation. However, GHAS does not intercept code at the generation layer, and it has no specific support for Claude Code or standalone Codex usage outside of GitHub’s own Copilot product. For enterprises using multiple AI coding agents, GHAS provides incomplete coverage.

Semgrep remains the tool of choice for teams that want maximum control over their security rules. The Semgrep community maintains hundreds of AI-code-specific rules contributed by the security research community, and Semgrep’s performance and CI/CD integration are excellent. However, Semgrep is fundamentally a pipeline-stage tool — it does not have the capability to intercept code at the generation layer, inject findings into agent context windows, or perform real-time package verification. For organizations that want pre-developer security enforcement, Semgrep requires pairing with other tools.

Best Practices for Enterprise Deployment

Based on AWS’s published reference architectures and the experience of enterprises in early access programs, the following best practices represent the highest-impact configuration decisions for Continuum deployments.

Start with Audit Mode, Then Enforce

The most common mistake in enterprise Continuum deployments is enabling blocking mode immediately for all developers. Blocking mode disrupts developer workflows — even when the blocks are correct — and creates resistance that can undermine long-term adoption. AWS recommends starting with a two-week audit period where Continuum runs in MONITOR_ONLY mode, logging all findings without blocking any suggestions. This gives the security team a realistic picture of the vulnerability patterns being generated in your environment, allows policy tuning before enforcement begins, and gives developers time to become familiar with the Continuum interface without experiencing workflow disruption.

Segment Policies by Repository Classification

Not all code carries equal risk. Internal tooling, developer utilities, and non-public-facing services do not require the same policy strictness as customer-facing APIs, payment processing code, or authentication services. Use Continuum’s Context Profile system to apply the Baseline policy bundle to internal tooling repositories and the Regulated Industries or Aggressive bundle to production service repositories. This prevents developer frustration from overzealous blocking in low-risk contexts while maintaining strong controls where they matter most.

Integrate Finding Data into Engineering Metrics

Security Hub Extended’s API makes it straightforward to export Continuum finding data into engineering dashboards alongside standard engineering metrics like build success rate, deployment frequency, and mean time to recovery. Treating the AI Code Security Score as a first-class engineering metric — reviewed in sprint retrospectives, tracked in team performance reviews, and visible in the same dashboards as reliability metrics — signals that AI code security is an engineering responsibility, not just a security team concern. Organizations that integrate ACSS into engineering metrics see significantly faster improvement in that score over time than organizations that treat Continuum as a pure security team tool.

Configure the Hallucinated Dependency Alert Pipeline

The hallucinated package name data that Continuum logs is extremely valuable, but only if it is acted on promptly. Configure Security Hub Extended to route all HALLUCINATED_DEPENDENCY findings to a dedicated channel — typically a Slack channel monitored by the security team — and establish a process for immediately checking whether the hallucinated package name has already been registered on public registries. If it has been registered recently, treat it as a potential malicious squatting incident and investigate whether any developer attempted to install the package before Continuum caught it.

Use the Remediation Diff View for Security Training

The Remediation Diff View in the IDE integration is one of Continuum’s most underutilized features. Incorporating diff view screenshots into security onboarding materials, lunch-and-learn sessions, and brown bag presentations gives developers concrete, real examples of exactly the types of security mistakes that AI agents make in your organization’s specific codebase. This is significantly more effective than abstract security training because the examples are drawn from actual AI-generated code in your environment, not from textbook examples that feel disconnected from daily work.

Establish a Policy Exception Workflow

There will be cases where Continuum blocks code that a developer believes is legitimately required. Without a clear exception workflow, developers will find workarounds — disabling Continuum locally, using a different AI agent without coverage, or simply writing the code manually outside the agent. A well-designed exception workflow acknowledges that security controls sometimes conflict with legitimate engineering requirements, provides a fast path (target: 24-hour turnaround for standard exceptions) for developer requests, and requires a documented rationale and an expiration date for every exception granted. Exceptions that expire and are repeatedly renewed are a signal that the underlying policy rule should be reconsidered. Building an AI Code Security Exception Management Program

Align Continuum Findings with Your SBOM Program

If your organization maintains a Software Bill of Materials (SBOM) for its products — which is increasingly required for federal contracts and is becoming standard in healthcare and financial services — Continuum’s dependency verification data is a valuable input to your SBOM generation process. Configure the Continuum Policy Service to export verified dependency data to your SBOM toolchain after each successful session. This gives your SBOM a real-time signal about which dependencies were introduced or modified by AI agents, which is particularly valuable for tracking the provenance of dependencies that were suggested by AI and might not have been subject to the same human review as manually chosen dependencies.

Conclusion: The Secure AI Development Imperative

The integration of AWS Continuum with OpenAI Codex and Anthropic Claude Code marks a turning point in the maturation of AI-assisted software development. For the first time, enterprises have a commercially viable, comprehensively integrated option for enforcing security policies at the generation layer — not just at the review layer, the commit layer, or the deployment layer. The difference is not merely technical; it is behavioral. Developers who write secure code because their AI agent generates secure suggestions develop different habits, different expectations, and different mental models than developers who write code that security tools later flag. The former is a foundation for durable security culture. The latter is a foundation for alert fatigue.

The challenges that AI coding agents introduce — insecure defaults, library hallucination, outdated API patterns, context-free code generation — are not going away. If anything, as AI agents become more autonomous and more deeply embedded in software development workflows, these challenges will intensify. An AI agent that can autonomously spin up a new microservice, configure its database, write its authentication layer, and deploy it to production is also an agent that can autonomously introduce SQL injection, hardcoded credentials, and dependency confusion into production infrastructure at machine speed. Continuum’s architecture — inline, pre-developer, policy-enforced, and centrally monitored — is the appropriate response to the scale and speed of that risk.

For enterprises that have not yet formalized their AI code security posture, the August 2026 announcement and the associated CISA guidance create a clear mandate for action. The tools are available, the integration points are defined, and the cost case is straightforward. The remaining variable is organizational commitment to treating AI code security as a first-class concern from the moment of code generation onward. AWS Continuum, properly deployed and configured, is currently the most capable platform available for delivering on that commitment across the three AI coding agents that dominate enterprise development environments in 2026.

The era of trusting AI-generated code without systematic verification is over. The era of AI agents that generate secure code by design — because security is enforced at the generation layer, not retrospectively at the review layer — has begun.