In my experience, they are fairly good at catching stuff in human-written code, but they tend to gloss over agent-written code, just as human beings being lulled to complacency by superficially-looking competent code.