Claude et al have “skills” that are basically containers of tools. It’s not a huge leap to say that similar tools are in use within these containers or even same. We don’t know.
I work in this field, have done work for some of the vendors we're discussing, and talk daily to security engineers working on these problems at these vendors. You are wrong.