Engineers can see what was scanned and why it blocked, and the assistant spends its tokens fixing code instead of looking for it.
LONDON — 29 October 2026 — Engineering organizations that build software with AI coding assistants pay for each security finding twice. The first bill arrives in reviewer hours, when vulnerable code lands in a pull request. The second comes in rework and model tokens, when someone relays the finding back to an assistant that has long since lost the context. Phoenix Security today announced general availability of Purple Hook, which moves the security check into the coding session.
Purple Hook is a local check that runs inside the AI coding assistant a developer already uses. It keeps Phoenix’s copy of the branch current and scans in the background after a push and when a pull request is opened. Results go straight back to the assistant, each finding with its file, line, severity and remedy attached, and the assistant fixes the code while the change is still open. The engineer sees what ran and why it blocked.
Where the cost lands
Most organizations scan at the pull request, in CI or on a schedule. All of those run after the assistant has finished. A reviewer triages the result, an engineer pastes the finding into a fresh session, and the assistant reads through the repository again to find the code and work out a fix. That costs a person time and costs the assistant tokens, at every step.
There is a trust cost as well. Engineers switch off checks that block without saying why, or quietly route around them.
What Purple Hook changes
The check runs where the work is happening. At the start of a session the hook asks Phoenix to fetch the branch. After a push it starts a scan and hands back a ticket, the assistant carries on, and the result shows up in the session on the assistant’s next action. Commits are not scanned and pushes are not held up. Opening a pull request triggers a scan of the whole branch against main, and the organization’s policy decides whether it blocks, warns or goes through.
Findings arrive ready to fix. The remedy for each one is built from Phoenix’s knowledge graph of the codebase, which maps files, functions, calls and imports, so the assistant goes straight to the fix. Only findings in the changed lines can block. A ten-line change is judged on those ten lines, whatever else sits in the backlog. Notices have a fixed size and state how many more findings exist, so a big result does not swamp the session. Administrators can switch on AI-suggested fixes, which are labelled as suggestions and cannot remove a finding or change a verdict.
The hook also shows its work. Each answer separates the findings that block from the others worth fixing and from any that were waived. When a scan is skipped or incomplete, the answer says so and gives the reason. Security teams set an organization-wide floor that individual workspaces may tighten, and the Enforcement page shows which repositories have the check installed and which have gone quiet. Phoenix’s server-side pull request check stays on as the enforced layer, so a repository without the hook is still gated.
Built on the graph that found three CVEs in Claude Code
Purple Hook uses the same code graph that Phoenix’s Purple Code Navigator research program used in March 2026, when Claude Code CLI v2.1.88 was published to npm with a source map that exposed its original TypeScript source. Phoenix began analysis the same evening and treated the CLI as software that handles untrusted input. Static analysis produced more than 100 findings. Triage on the Purple graph narrowed them to eight hypotheses, and runtime validation confirmed three OS command injection flaws (CWE-78), published as CVE-2026-35020, CVE-2026-35021 and CVE-2026-35022. Phoenix reported them to Anthropic on 31 March 2026.
The three share one root cause: configuration and environment values passed to a shell without sanitization. Chained, they turn a planted repository setting into credential exfiltration, and the risk is highest in CI/CD pipelines that run the assistant non-interactively against pull request branches. Command injection ranked ninth in the 2025 CWE Top 25. It is also one of the flaw classes Purple Hook stops at the pull request, where the assistant receives the remedy, structured arguments in place of a shell string, in the same session. Phoenix’s full technical write-up is available here.
Executive perspective
“Engineers turn off security checks they can’t read. So Purple Hook shows its work, and it hands the assistant the exact line and the fix, which means the tokens go into repairing code rather than hunting for it.”
— Francesco Cipollone, CEO and Co-Founder, Phoenix Security
How teams use it
An engineer asks an assistant to build a feature. The assistant pushes and moves on to the next task while the scan runs. A few minutes later two findings appear in the session with their files, lines and remedies. The assistant applies both fixes and pushes again. Nobody copies anything into a chat window.
In another session, an assistant tries to open a pull request with a critical finding in it. Under a blocking policy the request stops before any reviewer sees it, and the answer names the finding, the file and the remedy. The assistant corrects the code and tries again. Where a scan runs past the administrator’s wait, five minutes by default, the pull request opens with a ticket and the verdict follows.
False positives end with the command to request a waiver. An approver in the organization reviews the request, and once approved the finding moves to the Waived list with a link to the decision. Engineers still review and merge every pull request.
Availability
Purple Hook is generally available today for Phoenix Purple customers. It runs in the major AI coding assistants with the same policy and output in each. Every developer installs it with their own narrow key, which can run the check and do nothing else. Administrators configure policy under Settings > Scanning > Hook policy. Documentation and demos are at phoenix.security.
About Phoenix Security
Phoenix Security is an Actionable ASPM platform that correlates vulnerabilities from code to cloud, turning fragmented findings into a single, prioritized remediation flow. Through reachability analysis, contextual deduplication and risk-based prioritization, Phoenix helps security and engineering teams cut the noise, fix what counts and scale without scaling headcount. Phoenix Purple brings graph-native scanning to AI-generated code. Phoenix AI is assistive and human-aligned: teams review, approve and merge.
