Anthropic's Claude Code runs code to test if it is safe – which might be a big mistake

Checkmarx tested Anthropic's Claude Code automated security-review feature and found it can detect some common flaws (XSS, authorization issues) but also miss serious problems or produce false negatives (a pandas-based remote code execution was misclassified). The researchers warn that Claude Code's practice of generating and executing test cases can create additional risk (e.g., executing malicious third-party code) and recommend safeguards such as no production access from developer machines, human confirmation for risky AI actions, and strong endpoint security.