Chainguard opens a waitlist for Harness, a Claude Mythos 5.1 vulnerability hunter

What did Chainguard announce on 14 October?

Chainguard, the Seattle-based company best known for hardened container images and rebuilt open-source packages, announced Chainguard Harness in a press release dated 14 October 2026 at 01:00 ET. A launch post on Chainguard’s blog by Sam Katzen, its director of product marketing, describes Harness as a service that “uses frontier AI models like Anthropic’s Claude Mythos 5.1 to hunt down exploitable vulnerabilities in an organization’s application code and create a validated, reproducible report with recommended fixes.”

The launch has two parts. The first is the service itself, which opens today as a beta waitlist. The second is distribution: Harness is listed in Anthropic’s Claude Marketplace, so a company that already has a spending commitment with Anthropic can put part of that money toward Harness instead of signing a separate contract with Chainguard.

Chainguard frames the product around access. Its blog post says frontier models that can discover vulnerabilities across first-party and open-source code “have been mostly available to a select group of organizations performing defensive security work for critical infrastructure.” Anthropic offers security professionals versions of Claude with fewer cyber restrictions only through vetted programs such as its tiered Cyber Verification Program. Harness is Chainguard’s pitch to everyone else: you do not need your own access to the model, because Chainguard runs it for you.

Chainguard CEO and co-founder Dan Lorenc said in the release: “Every time we've pointed Harness at code, it has found serious, exploitable vulnerabilities, including in software that's been scanned many times over and code that runs critical infrastructure,” That is a vendor claim; Chainguard has not published a list of findings, a false-positive rate or a customer case study alongside the launch.

How does Chainguard Harness hunt for vulnerabilities?

The core idea is to attack the application the way it actually runs, instead of scanning source files for suspicious patterns. Chainguard’s blog lays out five steps:

The emphasis on reproduction is the main difference from a conventional static analysis tool. Static scanners flag code that looks risky, which often produces long lists of issues that may never be reachable in practice. Chainguard argues that this creates “a growing backlog of unverified alerts, with engineers spending hours and tokens triaging findings and writing their own patches instead of shipping.” By only reporting exploits it can trigger repeatedly against a running build, Harness trades breadth for confidence. The cost is that a bug the model cannot turn into a working exploit inside the sandbox will not appear in the report at all.

1. Connect repositories. The customer grants read-only access through the Chainguard GitHub App, called the Guardener app in the press release, or uploads a source archive.
2. Rebuild in isolation. Harness builds the application from source “exactly as it would ship to production” and boots it inside an isolated microVM.
3. Hunt for exploits. Mythos 5.1 probes the running application for logic flaws, injection and resource exhaustion, working from the source, git history, dependency source and build configuration while watching how the live app responds.
4. Prove every finding. Each exploit is replayed in a fresh microVM, and if it does not land every time it is dropped. Chainguard also checks that each recommended fix closes the hole: the exploit must succeed against the current code and fail against the patch.
5. Deliver the fix. The customer receives reproduction steps and a fix written for that codebase.

How does Chainguard keep Mythos 5.1 contained?

Pointing a model that is good at offensive security at real code raises an obvious question: what stops it from doing damage? Chainguard’s answer is to split each run into two phases.

In the setup phase, a separate model builds the application, fetches its dependencies and tooling, and gets it running inside the microVM. The microVM is then suspended. In the hunting phase it resumes for Mythos 5.1 with no network egress and no credentials inside. Chainguard says the model works only with a shell and packages Chainguard has built, and that the agent loop runs outside the sandbox, so every tool call and command the model issues is logged.

Chainguard also says it treats the code under test as untrusted data, to guard against prompt injection hidden in a repository, and that its reports describe how to confirm each issue rather than shipping a working attack. Containment is not a theoretical worry: Anthropic’s own Frontier Red Team has shown small models carrying out self-replication steps on cheap devices, and a group of scientists recently called for cyber-capable models to be air-gapped after containment failures. Chainguard has described its design but has not published an independent audit of it.

What does a customer actually get back?

Each engagement ends in a written report with an executive summary, the severity and impact of each finding, the steps to confirm it, and a recommended fix written for the customer’s code. Chainguard says “a named Chainguard engineer reviews and approves every fix and report before it reaches you,” and that “only Chainguard staff operate the model, and no one outside Chainguard can instruct it or see its raw output.”

At launch, the press release says, Chainguard engineers run Harness on customers’ behalf in two ways. They run it against the open-source artifacts Chainguard already distributes and ship patched builds through Chainguard Repository, and they run it against a customer’s own source code and deliver a reviewed report. If a flaw turns up in an open-source dependency rather than the customer’s code, Chainguard says it handles coordinated disclosure with the upstream maintainers through Athena, its disclosure process, and ships the patched build once the fix lands upstream.

This is closer to a managed security engagement than a self-serve scanner. Customers do not get a dashboard where they point Mythos 5.1 at code themselves. The Harness product page says the service is “currently in beta and is a Technology Preview under Chainguard’s Master Services and License Agreement,” which usually means fewer guarantees than a generally available product.

Why sell it through the Claude Marketplace?

The Claude Marketplace lets enterprises spend part of a committed Anthropic budget on approved Claude-powered products from other companies, with Anthropic handling the invoicing. InfoWorld reported its debut in March 2026 with partners such as GitLab, Harvey, Lovable, Replit, Rogo and Snowflake, and Anthropic broadened it on 23 September to bring connectors, plugins, products and service partners into one place. When we checked on 14 October, its products page listed 18 offerings, including Chainguard alongside security vendors Checkmarx, CrowdStrike and Cyera.

For buyers, the appeal is procurement. Large companies can take months to approve a new security vendor; drawing on an existing Anthropic contract can shorten that. Chainguard says Anthropic manages the invoicing, so customers can add Harness “without a separate procurement process and consolidate their AI spend.”

Anthropic endorsed the launch. Daniela Hurtado, Anthropic’s head of commercial cyber, said in the release: “Models like Claude Mythos 5.1 can surface vulnerabilities that have gone unnoticed for years, so how that capability is deployed matters as much as the capability itself,” She added that Harness surrounds the model with isolation, reproduction and human review. For Anthropic, the arrangement puts Mythos 5.1 in front of more defenders while a partner, not Anthropic, controls who can direct the model.

How does Harness compare with Anthropic’s own security programs?

Harness overlaps with programs Anthropic runs itself. On 8 October Anthropic launched OSS Scanner, a free, opt-in service that builds open-source projects in isolated virtual machines, audits them offline with its strongest models and emails maintainers reports that are not human-reviewed. The same day it announced a Critical Infrastructure Defense Program for operational-technology vendors.

The differences are audience and review. OSS Scanner is free and aimed at open-source maintainers, and its reports are fully model-generated. Harness is a paid service aimed at a company’s own application code, and every report passes through a Chainguard engineer. The Cyber Verification Program gives vetted security professionals direct model access with fewer refusals; Harness gives organizations the results without the access.

The launch also fits a broader shift toward building systems around frontier models rather than training new ones. Singapore’s new national strategy, published a day earlier, explicitly bets on “AI harness engineering” for the same reason. Chainguard published four other product posts on 14 October, covering Chainguard MCP, Workspaces, Checks and Go and .NET support in Chainguard Libraries, but Harness is the one built around a frontier model.

What is still unknown about Harness?

Several questions matter for anyone considering the waitlist:

Until Chainguard or early customers publish concrete findings, Harness is best read as a credible design from a supply-chain security company with a strong partner, not as a proven result. The reproducible-exploit rule and the human sign-off are the parts most worth testing.

• Price: neither the press release, the blog nor the product page gives a price, and the Claude Marketplace route depends on each customer’s Anthropic commitment.
• Results: Chainguard says Harness has found serious vulnerabilities every time it has been used, but it has not published examples, counts, severity data or a false-positive rate.
• Capacity: every report needs a named engineer’s sign-off, which may limit how many customers and codebases Chainguard can serve during the beta.
• Model choice: Chainguard refers to “frontier AI models like” Mythos 5.1, so it may use other models in some runs; the blog says a separate model handles the build phase.
• Coverage: Harness targets bugs it can exploit in a running build, so it complements, rather than replaces, static analysis, dependency scanning and human review.