Harness launches AI agents that triage and patch vulnerabilities

Harness Inc., a software delivery platform provider, has introduced AI agents capable of identifying software vulnerabilities and generating patches. Developers now have the authority to approve the fixes before any deployment. AI SAST conducts a deterministic static scan followed by an AI layer to filter out noise. The AI layer reduces false positives and identifies logic flaws that traditional tools often overlook.

After the filtering, the findings are passed to a Triage Agent, which narrows down the list to vulnerabilities that the software considers exploitable. A Remediation Agent then drafts a fix, verifies it, and creates a pull request against the vulnerable function. Meanwhile, a Zero-Day Agent monitors newly disclosed flaws around the clock and flags affected systems within the customer environment, often providing a validated fix within minutes.

Virtual patching prevents exploitation in production until the code fix is deployed, eliminating the need for code changes. Customers can also integrate their own large language model scanners into the triage workflow. Since attackers can exploit public disclosures into working exploits within six hours, the average vulnerability takes over 50 days to fix.

Harness's testing revealed frontier models detecting approximately ten times more vulnerabilities than conventional scanners. Most security teams lack the capability to manage such a high volume of findings. The release utilizes "Mythos-class" models, a reference to Anthropic's highly effective Mythos Preview model. This model has been in use by security teams since April through Project Glasswing.

Harness's CEO, Jyoti Bansal, emphasizes that attackers often use the same models that assist customers in efficiently delivering software. Security must become an integral part of the delivery pipeline, Bansal asserts. Currently, delays occur in handoffs between disconnected scanning, ticketing, and deployment systems. Rahul Sood, Harness's general manager of application security, highlights that all agents rely on a single set of reachability data, ensuring that only exploitable findings are considered.

The goal is to reduce the time window between discovery and deployed fix from weeks to hours. Harness acquired Sood during its September acquisition of Qwiet AI, incorporating Qwiet's Code Property Graph technology into the new scanning capabilities. These acquisitions are part of an 18-month security enhancement strategy at the company.

Additionally, Harness announced a merger with application programming interface security company Traceable Inc. in February 2025. Harness's Agent DLC, released on July 21, now audits and governs AI coding agents. The new agents and virtual patching are now available to Harness customers.