Anthropic’s Claude Code Sparks IBM Share Rout and Mainframe Market Concerns

Traditional static analysis relies heavily on existing rules, making it prone to missing contextual vulnerabilities involving business logic or access controls. Anthropic is using Claude to understand entire codebases in an effort to embed security reviews into development workflows. If companies cut spending on existing tools, the valuations of platform providers such as CrowdStrike and Palo Alto Networks, as well as financial institutions' procurement decisions, could be affected.

Anthropic launched a limited research preview of Claude Code Security for enterprise customers on February 20, 2026. Pricing was not disclosed, while open-source maintainers can apply for free access. Claude Opus 4.6 has identified more than 500 vulnerabilities. On February 23, CrowdStrike, Datadog and Zscaler fell about 11%, Fortinet and Okta dropped about 6%, and Palo Alto Networks declined 3%.

The cybersecurity industry has long relied on rules-based static analysis and manual reviews. Static tools struggle to detect contextual vulnerabilities involving business logic and access controls, while manual reviews are constrained by the supply of skilled professionals. Anthropic’s use of large language models to find vulnerabilities and draft patches could shift defenses from post-incident detection to the development stage. It is also prompting investors to reassess the pricing power and competitive barriers of traditional cybersecurity software.

Anthropic released a research preview of Claude Code Security on February 20, 2026. The tool can scan for vulnerabilities and propose patches that require human approval. On February 23, CrowdStrike, Datadog and Zscaler fell about 11%, while Fortinet and Okta dropped about 6%. CrowdStrike had lost 18% since the product’s release, wiping about $20 billion from its market value.

Anthropic is extending generative AI from coding into cybersecurity testing, posing potential competition to traditional security software providers that rely on rules-based detection and subscription models. Claude Code Security can analyze software components and data flows to identify complex vulnerabilities involving business logic and access controls, though fixes still require human approval. The launch prompted investors to reassess the pricing power and growth prospects of companies including Cloudflare and CrowdStrike.

Anthropic launched Claude Code Security as a research preview on February 20, 2026, and invited enterprise users to apply for access, saying Opus 4.6 had identified more than 500 critical vulnerabilities. Cloudflare fell 8.1% that day, CrowdStrike dropped 8% and a cybersecurity ETF lost 4.9%. On March 31, a Jefferies survey of 30 chief information officers found that none planned to cut cybersecurity budgets and redirect the money to AI.

Since its introduction in 1959, COBOL has underpinned critical systems at banks, airlines and government agencies. Anthropic says the language handles about 95% of U.S. ATM transactions. The high cost of switching has created a defensive moat around IBM’s mainframe and maintenance services. If Claude Code can automatically map dependencies and business logic, it could reduce the staffing needs and costs of multiyear modernization projects.

On February 23, 2026, Anthropic said Claude Code could automate COBOL discovery and analysis that previously took consulting teams years to complete. IBM shares plunged 13.2% that day to close at $223.35, their biggest one-day decline since October 18, 2000, wiping about $31.6 billion from the company’s market value. The stock’s cumulative decline in February reached 27%.