Agreed. I was trying to get it to review some auth refactoring in my app recently, and it appeared to find some vulnerabilities. as it was aggregating the results it was flagged and restarted the whole process with Opus 4.8 and all of my usage credits were gone.

Anthropic told me to use their `security-review` tool - as this was the exact scenario the tool is for - and it still got flagged.