Chainguard launches AI tool to find exploitable bugs

Chainguard has launched Chainguard Harness, an artificial intelligence security tool designed to identify and fix exploitable software vulnerabilities. The product is also available through Anthropic's Claude Marketplace.

The service uses frontier AI models, including Anthropic's Claude Mythos 5.1, to test a live build of an organisation's application code rather than relying solely on static analysis. It is intended to uncover vulnerabilities that conventional scanners may miss and to provide recommended fixes for confirmed findings.

According to Chainguard, Harness builds applications from source code inside an isolated microVM and runs tests against the live software instance. Findings are then reproduced in a fresh isolated environment before being passed to customers, along with reproduction steps and a proposed remediation reviewed by a Chainguard engineer.

The launch comes as software groups and security teams look for ways to use large language models in cyber defence without granting broad internal access to the most advanced systems. Chainguard is positioning Harness as a way for companies to use those models on their own code even if they do not have direct access to Anthropic's top-tier tools.

Runtime focus

Traditional software scanners have long been criticised for generating large volumes of alerts that developers must investigate manually. Chainguard says its approach is intended to reduce that backlog by focusing on vulnerabilities that are exploitable in a running application, including logic flaws, injection paths and resource exhaustion issues.

At launch, Chainguard engineers operate the service on behalf of customers. The tool can run against open-source artefacts the company already distributes, as well as a customer's own source code, before delivering a report covering validated findings, severity, impact, reproduction steps and recommended remediation.

That means the product does not simply expose an autonomous model directly to customer environments. Instead, it combines model-driven testing with isolation controls, repeat verification and human review before any findings are delivered.

Each run takes place in its own microVM sandbox, built from source on Chainguard OS, with no network egress, no credentials inside and full audit logging. Vulnerabilities found in open-source software will be disclosed to maintainers through the company's Athena vulnerability disclosure process.

Marketplace route

Availability through Anthropic's Claude Marketplace gives the product a commercial route aimed at companies already spending on Anthropic tools. Customers will be able to use part of their existing Anthropic commitment to buy the service, with Anthropic handling invoicing.

That arrangement may appeal to security and procurement teams seeking to adopt AI-based cyber tools without setting up a separate purchasing process. It also ties the product to a broader shift in which model providers are building marketplaces around specialist software and services rather than offering only direct model access.

Dan Lorenc, Chief Executive Officer and Co-founder of Chainguard, said the tool had already uncovered significant issues in heavily examined software. "Every time we've pointed Harness at code, it has found serious, exploitable vulnerabilities, including in software that's been scanned many times over and code that runs critical infrastructure," Lorenc said.

He added: "That capability is beginning to make its way to more and more organizations, and the teams that move first will be the ones that find and fix these issues before they become incidents. Harness offers another option for security teams to get proven vulnerabilities and fixes their engineers can ship."

Anthropic also framed the partnership around the controlled use of advanced models in defensive security work. "Models like Claude Mythos 5.1 can surface vulnerabilities that have gone unnoticed for years, so how that capability is deployed matters as much as the capability itself," said Daniela Hurtado, Head of Commercial Cyber at Anthropic.

She added: "Chainguard Harness surrounds Mythos 5.1 with isolation, reproduction, and human review, so defenders get the benefit, and every finding is verified before it reaches a customer. Through the Claude Marketplace, enterprises can put their existing Anthropic commitment directly toward that kind of risk reduction."

Chainguard said the service is available through a beta waitlist.