AI coding tools gain security — but the controls do not cut it

This report analyzes Anthropic’s new Claude Code security-review command and GitHub Action, which scan code for common vulnerabilities and provide fix suggestions, and compares them with similar capabilities from GitHub Copilot, Amazon CodeWhisperer, and Tabnine. Experts note these tools can catch obvious issues and have yielded internal wins (e.g., detecting RCE and SSRF risks), but they struggle with complex, novel, or cross-module vulnerabilities, incur cost and latency, and may foster a false sense of security without human review and traditional SAST/DAST. The piece advocates a multi-technique, defense-in-depth approach and views emerging agentic AI testing as a promising but nascent complement rather than a standalone solution.