Phoenix Security releases a code security check in AI agents

Phoenix Security announced general availability of Purple Hook on 29 October 2026. It is a small local check that operates in the AI coding assistant of a developer. It scans after a push and when a pull request (a request to merge code) opens. Its aim is to find security faults before a person inspects the code. Phoenix gave no test results or customer numbers.

How it works

After a push, the hook starts a scan and the agent continues. The result appears in the session at the next step of the agent. A pull request opens a scan of the full branch, and company policy selects if it stops, warns or passes.

Only results in changed lines can stop the work. Commits are not scanned.

The claim

Phoenix tells that teams pay two times for each result. First they pay in hours of inspection, then in more work and model tokens. It gave no figures for the savings.

What is not known

The Phoenix check on the server stays on, so a repository without the hook is also checked. Administrators can start AI suggested repairs, which cannot remove a result. No external test is given.

Insight: Security checks move into the agent

AWS engineers tell that hooks (control points in code around a model) are the answer when an agent goes out of control. The GitHub AI Scan for pull requests gives information only and cannot stop a merge. This reads as a move of the security gate from the end of the pipeline into the agent. The owner of the hook sees each push. Look at who owns that area.