This week · preprint, arXiv 2610.38617

On a test of 108 real vulnerabilities built by security-tools company Snyk, Snyk's own static scanner Snyk Code found 82.4% on average and Claude Code security review with Opus 5 found 79.3%; used together, the two found 101.

According to the paper's abstract, Snyk Labs published the test on October 28, with the vulnerabilities spread across 20 open-source web applications and 62 of them spanning multiple files. AI security review and conventional static scanning miss different vulnerabilities, and only the two together get close to the ceiling. Snyk built the test, and Snyk's own scanner scored highest. A static scanner reads source code for vulnerabilities without running the program. The 82.4% and 79.3% are the paper's average detection rates, or 89 and 85 vulnerabilities. The two tools disagreed on 28 vulnerabilities; Snyk Code was right on 16 and Claude Code on 12 (arXiv 2610.38617). The problem set and run logs are public on GitHub (snyk-labs/snyk-vulnbench). How we checked →

Concept illustration: a white chute runs down from a black banner lettered SNYK, which has a dog-head shield emblem beside the lettering, and red cards marked with black bug symbols slide along it into a long dark-grey tray piled with more of the same cards, while a small white box on a lower step in front of the tray holds two more. The tray sits between two black laptops, the left one lettered SNYK CODE and the right one lettered CLAUDE CODE with a speech bubble of grey lines above it, set in front of glass-walled rooms.

Source and checks

This item ran in the brief of Oct 30, 2026, alongside 13 other items. How we checked it, the quote checks and what was still missing that day are on that issue's How we checked page.

Cite this item

SecondSource (2026). "On a test of 108 real vulnerabilities built by security-tools company Snyk, Snyk's own static scanner Snyk Code found 82.4% on average and Claude Code security review with Opus 5 found 79.3%; used together, the two found 101.." https://secondsource.io/en/research/2026-10-30-1/. Accessed access date.