Harness has introduced new application security capabilities, including AI SAST, agentic triage and remediation, a dedicated Zero-Day Agent, and virtual patching. Together, the capabilities help security teams detect vulnerabilities, prioritize critical risks, and deploy fixes faster without relying on slow, disconnected security processes. As frontier AI accelerates attackers’ ability to exploit vulnerabilities, Harness aims to give defenders the automation and speed needed to keep pace.
Frontier AI models are now on both sides of the equation. Attackers are using them to find and chain vulnerabilities faster than ever, going from disclosure to first exploit in as little as six hours, while the average vulnerability still takes over 50 days to fix.
Defenders are gaining the same advantage, but unevenly: Harness’s own testing found frontier models surfacing roughly 10 times more vulnerabilities than traditional scanners, a wave of visibility that just becomes a bigger backlog without a faster way to act on it.
Harness’s view is that this is the new baseline, and every enterprise needs to be ready. This means having the ability to scan, triage, and ship a fix at the same machine speed those models now operate at, rather than relying on a security process built for a slower era.
“We’re at a point where the same AI models helping our customers ship software faster are also what attackers are using to find and exploit vulnerabilities faster,” said Jyoti Bansal, CEO and Co-Founder of Harness. “The only way to close that gap is to make security a first-class part of the delivery pipeline itself, so scanning, prioritization, remediation, and deployment all move together instead of getting stuck in handoffs between disconnected systems. That’s the shift we built this launch around, and it’s the same shift every enterprise is going to have to make to stay ahead.”
Launching Agents Across the Vulnerability Lifecycle
Today’s announcement covers every stage a vulnerability moves through, from the moment it’s found to the moment it’s shielded in production, so no one slow step holds up the rest of the chain. Here’s a look at what’s shipping:
-
AI SAST: A deterministic scanning engine paired with an AI layer that filters out noise, cutting false positives dramatically while catching issues, like missing authorization checks, that traditional tools miss entirely.
-
Claude Scan Orchestration: Teams that want to run their own Claude-based scanners can now do it natively inside their pipeline, with results feeding directly into the same triage and remediation workflow as everything else.
-
Triage Agent: Automatically sorts the flood of scanner findings down to what’s actually exploitable, so teams can focus their time on real risk.
-
Remediation Agent: Writes and validates a fix for a prioritized finding and opens a pull request for a developer to review, pinpointing the exact vulnerable function so teams aren’t wasting time on dependencies that were never actually reachable.
-
Zero-Day Agent: Monitors for newly disclosed zero-days around the clock, instantly identifies every affected system across a customer’s environment, and has a validated fix ready for review, often within minutes of a threat going public.
-
Virtual Patching: Deploys a protective patch the moment a vulnerability is discovered during testing, no code changes required, shielding production immediately while the real fix is finished behind the scenes.
“For customers, this means the distance between ‘we found something’ and ‘it’s fixed and deployed’ shrinks from weeks to hours, without adding headcount or a new tool to manage,” said Rahul Sood, GM of AppSec at Harness. “Every agent in this launch is built on the same reachability data, so teams aren’t just moving faster, they’re spending that speed on the vulnerabilities that actually matter instead of chasing noise.”
Partnering with Anthropic’s Claude
Harness’s AI security capabilities, including AI SAST, the Zero-Day Agent, and the Triage and Remediation Agents, integrate Anthropic’s Claude models among the large language models powering the platform. As part of today’s launch, customers can also integrate findings from scanning their code with Claude directly into their Harness pipeline, bringing Claude-based scanning into the same triage and remediation workflow as everything else.
“Claude reasons across a codebase the way a human researcher would, tracing how a vulnerability actually behaves in context,” said [First Name Last Name], [Title], Cybersecurity, Anthropic. “Feeding those findings directly into Harness’s pipeline means customers get the depth of an LLM-based scan without it becoming a separate process to manage on top of everything else.”
Extending Harness’s AI Security Momentum
Harness has had sustained investment in AI-driven security since its merger with Traceable in early 2025. Today’s announcement continues that trajectory, following the July 21 launch of Agent DLC, which brought governance and chain of custody to AI coding agents across the software delivery lifecycle. It’s also the latest step alongside new integrations with Kong and Google, extending Harness’s security and governance capabilities across a wider range of infrastructure and platform partners.
Taken together, these efforts point to the same conclusion: as AI reshapes both software delivery and the threats against it, security has to be built into the platform itself. Harness plans to keep extending this work as the AI models on both sides of that equation keep getting more capable.
To learn more, visit: https://www.harness.io/
Related News:
Instabase Becomes SuperApp, Launching New AI Collaboration Platform
