Two unrelated things landed today, and I think they're worth covering together, because one is exactly the kind of progress I like writing about, and the other is a reminder of why I keep being careful about which numbers I actually repeat.
The genuinely useful one
Anthropic shipped a free plugin for Claude Code that reviews code changes for injection flaws, unsafe deserialization, and insecure DOM handling, all during the same session you're already working in, rather than as a separate step you have to remember to run later. That's a real, no-cost addition to the /security-review command I wrote about back in March, and it fits the pattern I keep saying actually moves the needle: security help that shows up inside the normal workflow, not something bolted on separately that only helps the person who already knew to reach for it.
The one I'm not going to repeat as fact
Separately, a new post went up today reusing the claim that 62% of AI-generated code ships with vulnerabilities. I looked into this exact figure back when I was researching sources for this blog, and it traces back to a broken citation chain, one post linking to the wrong paper, that never actually contained this number, with the figure just getting repeated forward from blog to blog since. The post today cites a real, separate statistic elsewhere in its own text, one from actual academic research, that doesn't match the headline number it's leading with. I'm not naming a villain here. I think this is a completely ordinary case of a citation getting detached from its source somewhere upstream and nobody downstream re-checking it before repeating it again.
Why I'm flagging this instead of just ignoring it
This is exactly the discipline I've tried to hold myself to on this blog: check a number before repeating it, and say so plainly when I can't verify one, rather than passing along whatever sounds authoritative. A specific, dramatic-sounding statistic is more shareable than "we don't have a solid number for this," which is exactly why the unconfirmed version keeps outrunning the honest one. If you want a real, checkable figure for this general claim, Veracode's actual GenAI Code Security testing, which I've cited before, is the one with a traceable methodology behind it.
The pattern underneath both stories
A genuinely good tool shipping quietly, and a shaky number getting repeated loudly, can both happen on the same day, in the same general conversation about AI code security. Neither one should be taken purely on the strength of how confidently it's presented. The plugin is worth trying because it's free, low-friction, and does something concrete you can verify yourself. The stat is worth skipping specifically because nobody repeating it has actually shown their work.