Security benchmark finds combined static and AI reviews catch 101 of 108 flaws

A preprint evaluating security tools found that combining Snyk Code with Claude Code using Opus 5 at xhigh effort detected 101 of 108 reference vulnerabilities. Individually, the tools found 89 and 85 respectively. The benchmark covered 20 open-source web applications and credited findings only when they identified both the attacker-controlled input and the dangerous operation within two lines. The study also found that review policies and file selection affected detection. Without Claude Code's built-in review policy, the same model matched 16 rather than 9 vulnerabilities in restricted classes in a supplementary run. That run covered 19 of the 20 applications.