Seattle – October 14, 2026 -- Chainguard has launched Chainguard Harness, a cyber harness that runs frontier AI models such as Anthropic's Claude Mythos 5.1 against a live build of a customer's application and delivers only reproduced vulnerabilities, each paired with an engineer-reviewed fix. The product is available through the Claude Marketplace by Anthropic, so enterprises can buy it with their existing Anthropic commitment.
Harness tests running applications in isolated microVMs instead of scanning static code
Harness connects to a team's repository through the Guardener GitHub app, builds the application as it ships, and boots it in an isolated microVM. A frontier model then probes the running instance the way an attacker would. Chainguard says this approach surfaces logic flaws, injection paths and resource exhaustion bugs that appear only at runtime and that traditional static scanners miss.
Every finding is replayed in a fresh, isolated environment until it reproduces every time. Chainguard says this cuts false positives and the backlog of unverified alerts that forces engineers to spend hours and tokens on triage instead of shipping.
Chainguard targets customers without direct access to frontier vulnerability-hunting models
According to Chainguard, access to frontier models that discover vulnerabilities across first-party and open source code has been limited mostly to a select group of organizations doing defensive security work for critical infrastructure. Harness gives other teams that capability without requiring their own model access.
CEO and co-founder Dan Lorenc said Harness has found serious, exploitable vulnerabilities in every codebase it has examined, including software scanned many times before and code that runs critical infrastructure.
Every run uses a sandbox with no network egress, no credentials and full audit logging
Each run executes in its own microVM sandbox built from source on Chainguard OS. The sandbox has no network egress and no credentials inside, and all activity is audit-logged. A Chainguard engineer reviews and approves every fix and report before it reaches a customer.
Vulnerabilities found in open source code go upstream to maintainers through Athena, Chainguard's coordinated vulnerability disclosure process.
Chainguard engineers operate Harness for customers at launch
At launch, Chainguard staff run the tool on customers' behalf in two ways. They run it against the open source artifacts Chainguard already distributes and deliver patched builds through Chainguard Repository. They also run it against a customer's own source code and return a reviewed report listing validated findings with severity, impact, reproduction steps and recommended remediation.
Anthropic handles invoicing for Harness purchases through the Claude Marketplace
Enterprises can apply part of their existing Anthropic commitment to Harness. Anthropic manages invoicing, so customers can add the product without a separate procurement process and consolidate AI spend.
Daniela Hurtado, Head of Commercial Cyber at Anthropic, said Harness wraps Mythos 5.1 in isolation, reproduction and human review so that every finding is verified before it reaches a customer.
Harness is currently available through a beta waitlist.