Harness launches AI agents to triage and patch software vulnerabilities

The new tools include AI SAST, which runs a deterministic static scanner and applies an AI layer to strip out noise. Harness said that layer cuts false positives and catches logic flaws such as missing authorization checks, which conventional tools tend to miss entirely. What survives goes to a Triage Agent, which narrows the pile to findings the software judges exploitable. A Remediation Agent drafts a fix, validates it and opens a pull request against the vulnerable function.

A Zero-Day Agent watches newly disclosed flaws around the clock and flags affected systems across a customer environment, often with a validated fix ready within minutes. Virtual patching blocks exploitation in production until the code fix ships, and no code changes are required for it. Customers running their own large language model scanners can also pipe those results into the triage workflow.

Harness said attackers using frontier models can move from a public disclosure to a working exploit in as little as six hours, while the average vulnerability takes more than 50 days to fix. Testing by Harness found frontier models surfacing roughly 10 times more vulnerabilities than conventional scanners, and the company argues most security teams have no realistic way to work through that much output.

The release invokes “Mythos-class” models, a nod to Claude Mythos Preview. Anthropic PBC has kept that model out of general release because of how well it finds and chains software vulnerabilities. Defenders have had access since April through Project Glasswing.

Co-founder and Chief Executive Jyoti Bansal said attackers are using the same models that help Harness customers ship software quickly, so security has to become “a first-class part of the delivery pipeline itself.” Work currently stalls in handoffs between disconnected scanning, ticketing and deployment systems. Rahul Sood, general manager of application security at Harness, said the agents all draw on one set of reachability data, keeping teams off findings that were never exploitable to begin with. He added that the window between discovery and a deployed fix should shrink “from weeks to hours.”

Sood joined Harness in its September acquisition of Qwiet AI, and Qwiet’s Code Property Graph technology underpins the new scanning work. The deal was part of an 18-month security buildout that also included a merger with Traceable Inc. in February 2025 and the July 21 release of Agent DLC, which audits and governs AI coding agents. The new agents and virtual patching are available now to Harness customers. Harness is a venture capital-backed company that last raised $240 million at a $5.5 billion valuation in December.