Claude Code

## What it is Claude Code is Anthropic's own coding agent, not a plugin bolted onto someone else's editor. It started as a limited research preview in February 2025 alongside Claude 3.7 Sonnet and reached general availability in May 2025. Since then Anthropic has pushed it well past "CLI that edits files": it now runs from a terminal, a VS Code extension, a JetBrains plugin, a standalone desktop app, a browser at claude.ai/code, and the Claude mobile apps, all sharing the same project memory (CLAUDE.md files), MCP server connections, and settings. It can spin up parallel subagents, run on a schedule via Routines, and hand a task off between devices mid-session. The core pitch is codebase awareness without manual file selection: point it at a repo and it uses agentic search to find the relevant files itself, rather than relying on the developer to @-mention them. It works directly with git — staging changes, writing commit messages, opening PRs — and integrates with GitHub Actions and GitLab CI/CD for automated review and issue triage. ## Who it's actually good for This is a tool for developers who are comfortable delegating multi-step work and reviewing diffs after the fact, not for people who want to watch every keystroke. The terminal-first design rewards people who already live in a shell: piping logs into it, chaining it with other CLI tools, running it non-interactively in CI. Reviewers on G2 and in independent 2026 comparisons consistently point to the same strength: it holds more of the codebase's architecture in context than tab-completion tools, which shows up on larger refactors and cross-file changes rather than single-function edits. It is a weaker fit for anyone who wants a tightly IDE-integrated, visual diff-first workflow — several G2 reviewers specifically called out that reviewing file changes in Claude Code feels less comfortable than in GitHub Copilot's interface, even though the underlying edits were sound. It's also not the right tool for someone who wants freedom to swap in a different agent harness while keeping a Max subscription; Hacker News commenters have flagged that Anthropic's paid plans are tied to Anthropic's own harness, unlike some competitors that let you point a subscription at third-party tooling. ## Strengths, with specifics - **Multi-surface continuity.** A CLAUDE.md file, MCP servers, and settings carry across terminal, IDE, desktop, and web sessions, so a task started locally can be picked up from a phone via Remote Control or Teleport. This is a genuinely differentiated piece of engineering, not marketing dressing — it solves a real problem (long-running agent tasks that outlive a single sitting at a desk). - **Deep git and CI integration.** Native GitHub Actions and GitLab CI/CD support, plus a dedicated GitHub code-review flow, let teams trigger Claude Code from pull requests rather than only from an interactive session. - **Independent comparison pieces from 2026** rank it ahead of Cursor and GitHub Copilot on SWE-bench Verified (one comparison cites 80.8%) and on developer sentiment surveys, with Claude Code cited as the most "loved" tool in the category by a wide margin over Cursor and Copilot. These are third-party-reported figures, not something we independently reproduced, and SWE-bench performance does not automatically translate into everyday reliability. - **Extensibility.** Skills, hooks, and subagents give teams a way to package repeatable workflows (a `/deploy-staging` command, an auto-format hook) rather than re-prompting from scratch each time. ## What's actually wrong with this The most substantiated weakness is security, and it's not a single incident. Over 2026, security researchers and vulnerability databases documented multiple distinct CVEs in the Claude Code CLI: an OS command-injection flaw (CVE-2026-35021) where shell metacharacters in file paths could reach `execSync` and achieve remote code execution; a critical authentication-helper injection bug (CVE-2026-35022, rated CVSS 9.3) that let an attacker execute arbitrary commands and exfiltrate credentials, including conversation history; a `find`-command parsing bug (CVE-2026-24887) that could bypass the confirmation prompt meant to stop untrusted command execution; and a piped-`sed` bug (CVE-2026-25723) that could write outside the intended project scope. Independent security outlets also reported that Claude Code's own source was briefly exposed via an npm packaging error, and that the resulting leak was used as a lure in a separate social-engineering campaign. None of this means the product is unsafe to use with ordinary care and prompt patching — Anthropic did ship fixes — but a tool that runs shell commands against a developer's machine with this many distinct injection-class findings in one year is a legitimate caution, not a footnote. Separately, community sentiment softened over the course of 2026. A widely discussed Hacker News thread ("Ask HN: Is it just me or is Claude Code getting worse?") captured user suspicion that usage limits were quietly tightened even during a period Anthropic advertised as a usage boost. Anthropic's own messaging — doubling limits in May 2026, then running a temporary 50% weekly boost through the end of August 2026 — is consistent with limits being an active lever the company adjusts, which cuts against the idea of a stable, predictable allowance for heavy users on a fixed monthly price. The review-site sample size is also thin: the G2 listing we found showed a 4.9/5 average, but from only 15 reviews, which is not enough volume to treat as a settled verdict on user satisfaction — it's a positive early signal, not proof. ## Pricing reality Claude Code is not sold standalone. It rides on Anthropic's Claude subscription tiers or a pay-as-you-go API key. Per Anthropic's pricing page: Pro is $17/month billed annually (or $20 month-to-month) and is the cheapest tier that includes Claude Code at all; Max 5x starts at $100/month for roughly five times Pro's usage; Max 20x runs $200/month for a further step up. Team seats are $20/month (annual) or $25 (monthly) for a standard seat, and $100/$125 for a premium seat, with usage shared across the organization's plan. Enterprise adds a per-seat base plus usage fees, SSO, SCIM, audit logs, and compliance controls. Because usage limits are shared across Claude's chat, Cowork, and Code surfaces on a single subscription, a developer who also uses Claude for general chat work is drawing from the same pool as their coding sessions — worth knowing before assuming a $20 Pro seat covers a full-time coding workload. ## Verdict Claude Code is a legitimately strong, fast-moving agentic coding tool with a genuine architectural advantage — one memory and tooling layer across terminal, IDE, desktop, and web — and third-party comparison and sentiment data that puts it ahead of Cursor and GitHub Copilot on several axes as of mid-2026. It earns real credit for that. But 2026 also produced a concentrated run of shell-injection-class CVEs and a vocal, plausible community complaint about usage limits moving under paying subscribers' feet, and no amount of feature breadth erases either. Treat it as a strong default choice for a terminal-comfortable developer or team, provisioned with current patches and sane permission settings, rather than as an obviously safe pick for a security-sensitive environment without further diligence. ## Quick take **Verdict:** A genuinely capable, architecturally distinctive coding agent that developers rate highly, held back by a concentrated 2026 run of shell-injection CVEs and shared usage limits that reportedly move under paying users. **Choose it if:** - You're comfortable working from a terminal and want an agent that plans and executes multi-step, multi-file tasks rather than just completing lines - You want one tool whose memory and context follow you across CLI, IDE, desktop, web, and mobile - You need native GitHub Actions or GitLab CI/CD integration for automated review and issue triage - You're already paying for a Claude Pro/Max/Team plan and want coding capability included rather than a separate subscription **Skip it if:** - You want a tightly visual, diff-first review workflow inside your existing IDE — reviewers describe Copilot's change-review UX as more comfortable - You run in a security-sensitive environment and haven't reviewed Claude Code's 2026 CVE history and current patch level - You want to keep a single Anthropic subscription but plug in a different agent harness - You need a fixed, predictable usage allowance rather than a shared pool across chat and coding that Anthropic has adjusted more than once in 2026 **Watch out:** Claude Code shares usage limits with Claude's chat and Cowork surfaces on the same subscription, and 2026 saw Anthropic both boost and tighten those limits at different points — heavy coding users on a fixed-price plan should not assume a stable monthly allowance without checking current terms.