Jason M. Lemkin argues the AI security panic is overblown because Claude Code already does detailed security audits, static code reviews, and penetration testing through Replit, Vercel, or Lovable. These capabilities have existed for months and often outperform mediocre engineers.
Is this a dramatic overreaction from public markets, or is there underlying truth to this? Well, I'll tell you the interesting thing to me. This kind of shows where the markets are and where our mass panic is, although I think our panic is, is well-grounded. I think we should be panicking. But most of this already exists. You can go to Claude Code today, and I literally did this on the plane flying back last week. Okay. I did it inside of Replit and you can say, run a detailed security audit on my code and it will already do it. It will already run a total static code review. And if you're live on, if you're on Replit or Lovable or Vercel or something, it will actually do penetration testing and everything for you. Like literally it will do everything. It will already, it can already do, I think, a better security audits and testing than a mediocre board engineer will ever do. So what I mean is I'm not, it's obviously the pace at which things are getting better. Like it's, it's, I mean, each week we can't keep up, you know, on this show. But it's also interesting that conceptually, just like reviewing COBOL code dropped IBM 10%, it already existed. Like we're panicking about features that have already been in Claude for months in many cases. Now, is this a sign that it will go more aggressively into the space? Of course it is, right? Of course it is. But I just want to point out to folks that aren't doing it, it's all so much of the stuff that we are panicking about, I think is worth panicking about, but a total nothing burger in the sense that if you're paying attention, it's This is months-old news in some ways.
The first comment, the just general comment is, you know, Anthropic, you know, markets itself as, you know, the nice AI company. And for a nice AI company, it sure creates a lot of damage and kills a lot of stock portfolios. Maybe the Pentagon is wrong and they need to buy more Anthropic and just point it at the enemy. It'll bring China to its knees, right? This is an astonishingly destructive thing.
Incredibly destructive. Incredibly destructive.
Yeah. Have a press conference, clip $20 billion off something. But let's do security first, 'cause in this case, from a technical capabilities perspective, no surprise. Second, from an adoption in the enterprise perspective, I don't see Anthropic eating up CrowdStrike's business. I just don't see that. No one is going, people are gonna have a security layer. And there was a great, I think it was an HSBC report out today after the Citrini madness, which we'll talk about in a second, that basically said, "Software is the means by which AI will diffuse into the enterprise," which I thought was a wonderful quote. And I think it'll be true for security also. In other words, these capabilities like code scanning will diffuse into the enterprise probably by means of companies like CrowdStrike and other companies like them bringing it to bear. So at that level, it, at that level, A, no new news, and B, it shouldn't be such a big panic.
