Chainguard has introduced Chainguard Harness, a cybersecurity solution that leverages frontier AI models, including Anthropic’s Claude Mythos 5.1, to identify and remediate exploitable application vulnerabilities. It builds applications from source code in isolated microvirtual machines, uses advanced AI to analyze running applications for security weaknesses, and validates each finding before providing a tailored, staff-reviewed fix. This enables organizations to benefit from advanced AI-powered vulnerability discovery without requiring direct access to frontier models, helping teams focus on verified risks instead of false positives. Chainguard Harness is available through the Claude Marketplace, allowing customers to purchase the solution directly from Anthropic and consolidate their AI spending.
Finding vulnerabilities is no longer the hard part
Frontier AI models have become remarkably effective at finding and chaining exploitable vulnerabilities, but most organizations cannot put that capability to work on their own code. Access to frontier models that perform vulnerability discovery across first-party and open source code has been mostly available to a select group of organizations performing defensive security work for critical infrastructure. Traditional scanners add to the problem: they analyze static code, flag issues that may never be reachable, and miss the logic flaws, injection paths, and resource exhaustion bugs that only appear when an application is actually running. The result is a growing backlog of unverified alerts, with engineers spending hours and tokens triaging findings and writing their own patches instead of shipping. Chainguard Harness closes the gap by finding exploitable, reproducible vulnerabilities and providing fixes for both open source and first-party code.
“Every time we’ve pointed Harness at code, it has found serious, exploitable vulnerabilities, including in software that’s been scanned many times over and code that runs critical infrastructure,” said Dan Lorenc, CEO and Co-founder, Chainguard. “That capability is beginning to make its way to more and more organizations, and the teams that move first will be the ones that find and fix these issues before they become incidents. Harness offers another option for security teams to get proven vulnerabilities and fixes their engineers can ship.”
Proven vulnerabilities, with fixes written for your code
Chainguard Harness connects to a team’s repository through the Guardener GitHub app, builds the application exactly as it ships, and boots it in an isolated microVM. A frontier model then probes the live application for exploitable vulnerabilities, testing it in context, the way an attacker would, rather than reading static code. Every finding is replayed in a fresh, isolated environment until it reproduces every time, so teams only see what is proven. When a vulnerability is confirmed, Chainguard delivers reliable reproduction steps alongside a fix written for that specific codebase.
Chainguard Harness includes:
● Frontier AI without frontier access: Teams get the benefit of frontier-model vulnerability hunting on their own applications without needing their own access to frontier models.
● Built for the bugs that live at runtime: The harness tests a running copy of the application instead of just static code, surfacing logic flaws, injection, and resource exhaustion that only show up in context.
● Isolation by design: Every run happens in its own microVM sandbox built from source on Chainguard OS, with no network egress, no credentials inside, and full audit logging.
● Reproducible, verified findings: Every finding is replayed in a fresh, isolated environment until it lands every time, reducing false positives and security noise.
● Fixes written for your code: Custom recommendations across first-party code and open source dependencies give teams a path to secure code, not a list of risks.
● Human review on every fix: A Chainguard engineer reviews and approves every fix and report before it reaches a customer.
● Responsible disclosure built in: Vulnerabilities found in open source go upstream to
maintainers through Athena, Chainguard’s coordinated vulnerability disclosure
process.
At launch, Chainguard engineers operate Harness on behalf of customers by running it against the trusted open source artifacts Chainguard already distributes and delivers patched builds via Chainguard Repository, and by running it against a customer’s source code and delivering an engineer-reviewed report of validated findings with severity, impact, reproduction steps, and recommended remediation.
Available through the Claude Marketplace by Anthropic
Chainguard Harness is available through the Claude Marketplace by Anthropic, allowing enterprises to use a portion of their existing Anthropic commitment to procure it. Chainguard Harness reproduces vulnerabilities discovered by Mythos 5.1 in an isolated environment, ensuring every fix is reviewed by a Chainguard engineer, and sharing results that customers can act on immediately. Anthropic manages invoicing, so Anthropic customers can add Harness without a separate procurement process and consolidate their AI spend.
“Models like Claude Mythos 5.1 can surface vulnerabilities that have gone unnoticed for years, so how that capability is deployed matters as much as the capability itself,” said Daniela Hurtado, Head of Commercial Cyber, Anthropic. “Chainguard Harness surrounds Mythos 5.1 with isolation, reproduction, and human review, so defenders get the benefit, and every finding is verified before it reaches a customer. Through the Claude Marketplace, enterprises can put their existing Anthropic commitment directly toward that kind of risk reduction.”
Related News:
Chainguard Reaches 94% Coverage Across Python, Java, and JavaScript
Chainguard Container Images Surpass 500 Million Container Build Manifests
