Phoenix Security launches Purple Hook to move code scanning into AI coding sessions

Phoenix Security has made Purple Hook generally available, a local security check that scans AI-generated code inside tools like Claude Code, Cursor and Codex before vulnerable code reaches human review. The company says the approach cuts reviewer overhead, keeps assistants in context and lets security teams enforce policy without slowing developers down.

Why it matters: - Engineering teams using AI coding assistants often pay twice for the same security issue: once in reviewer time and again when someone reopens the context for the assistant to fix the code. - Purple Hook moves the security check into the coding session, which can reduce rework, cut token usage and keep fixes in the agent that wrote the code. - The product also aims to reduce the trust cost that comes from blockers that do not explain themselves.

What happened: - Phoenix Security announced general availability of Purple Hook, a local security check built for AI coding assistants. - The hook runs inside tools developers already use, including Claude Code, Cursor and Codex. - Phoenix says the check scans what those assistants try to push and sends the fix back before vulnerable code reaches a human reviewer. - The release came from Austin, Texas, on Oct. 29, 2026.

The details: - Purple Hook keeps Phoenix's copy of the branch current and scans in the background after a push and when a pull request opens. - Findings go back to the assistant with the file, line, severity and remedy. - The engineer can see what ran and why the code was blocked. - At session start, the hook asks Phoenix to fetch the branch. - After a push, the hook starts a scan and returns a ticket while the assistant keeps working. - Opening a pull request triggers a full-branch scan against main. - Organization policy determines whether the result blocks, warns or passes. - Only findings in changed lines can block. - Phoenix's knowledge graph maps files, functions, calls and imports so the assistant can move directly to the fix. - Notices have a fixed size and show how many more findings exist, so large results do not overwhelm the session. - Administrators can enable AI-suggested fixes, which are labeled as suggestions and cannot remove a finding or change a verdict.

Between the lines: - Phoenix is trying to shift security left even further than the pull request by placing the check inside the agent workflow itself. - The design favors developer flow: commits are not scanned, pushes are not held up and the assistant receives results on its next action. - The system also makes enforcement more transparent by separating blocking findings, fixable findings and waived items. - When a scan is skipped or incomplete, the response says so and explains why. - Security teams can set an organization-wide floor, while individual workspaces can tighten policy. - Phoenix's server-side pull request check remains the enforced layer, so repositories without the hook are still gated.

What's next: - Security teams can roll out the hook through the Enforcement page, which shows which repositories have the check installed and which have gone quiet. - Organizations can decide whether AI-suggested fixes should be enabled. - The server-side pull request gate remains in place as the backstop for repositories that do not use the local hook.

The bottom line: - Phoenix Security is betting that the fastest security fix is the one that happens before code leaves the assistant.