New service lets AI hunt for holes in companies' own code

Security company Chainguard announced a new service called Harness on October 14, 2026. It uses an advanced AI model to find vulnerabilities that others could exploit in an organization's own code. The model is Anthropic's Claude Mythos 5.1.

Tests the program while it runs

Harness first builds the program from the source code in an isolated, secure environment known as a microVM. That is a small virtual computer that is sealed off from the outside world. The AI model then examines the running program for flaws such as logic errors, injection attacks and resource exhaustion.

According to Help Net Security, this sets it apart from traditional scanners, which only analyze the code statically, meaning without the program running.

According to Chainguard, the hunting phase itself runs without network access and without credentials in the microVM. The code under examination is treated as untrusted data.

Findings must be repeatable

Before a finding counts, Harness tries to repeat it in a new, isolated environment. Findings that cannot be reproduced do not make it into the report. This is meant to limit false alarms.

The customer receives steps to reproduce the finding and a fix tailored to the customer's own codebase. The fixes are reviewed by humans at Chainguard.

Customers can connect their GitHub repositories via Chainguard's GitHub App or upload source code. They get access to the advanced model without needing to have access to it themselves.

Beta and waitlist

Harness is launching as a beta for a limited number of organizations, and there is a waitlist. Initially, the service is run by Chainguard engineers on behalf of customers.

The service is sold through Anthropic's Claude Marketplace, and customers can use part of their existing Anthropic commitments for the purchase. The price has not been disclosed.

Chainguard CEO Dan Lorenc says, according to Help Net Security, that every time Harness has been pointed at code, it has found serious vulnerabilities that can be exploited. That is Chainguard's own claim, and it has not been independently verified.

For vulnerabilities found in open source, meaning freely available code, Chainguard says it uses responsible disclosure. That means the owners are notified so the flaw can be fixed.