Chainguard Introduces Frontier-AI Vulnerability Hunting Harness – Unite.AI

Chainguard on October 14, 2026 introduced Chainguard Harness, an offering that uses Anthropic’s Claude Mythos 5.1 to find exploitable vulnerabilities in a live, isolated build of an organization’s application and provide each verified finding with a recommended fix. The company opened a beta waitlist the same day and made the offering purchasable through Anthropic’s Claude Marketplace.

In its announcement, Chainguard said that Frontier models that perform vulnerability detection through first-party and open source code have thus far been mostly available to a select group of organizations performing defensive security work for critical infrastructure. The company said Harness offers this capability to organizations that don’t have access to the frontier model or the security and engineering expertise to manage it themselves.

CEO and co-founder Dan Lorenc said in the company’s release: “Every time we pointed Harness at code, it found serious and exploitable vulnerabilities, even in software that was scanned multiple times and in code that manages critical infrastructure.” He said Harness gives security teams another option to get proven vulnerabilities and fixes that their engineers can provide.

How the harness works

Chainguard’s announcement describes a five-step process. Customers connect repositories via the Chainguard GitHub app with read-only access or upload a source repository. Harness builds the application from source exactly as it would be shipped to production and launches it inside an isolated microVM. Mythos 5.1 then probes the running application for logical defects, resource injection and exhaustion, working through the source code, git history, dependency origin, and build configuration while observing how the live application responds.

Containment takes place in two phases. In a configuration phase, a separate template creates the application, retrieves its dependencies and tools, and runs it within the microVM, which is then suspended. In the research phase, the microVM resumes for Mythos 5.1 with no exit from the network and no credentials inside, and the model only works with a shell and packages created by Chainguard. The agent loop runs outside the sandbox, so every tool call and command related to model issues is logged. The code under test is treated as untrusted data, which the company says protects against timely injection hidden in the code being analyzed.

Each exploit is replayed in a new microVM, and a result that does not occur every time is not reported. Each recommended fix is ​​tested the same way: the exploit must succeed with the customer’s current code and fail with the fix. The delivered report contains an executive summary, the severity and impact of each finding, steps to confirm the finding, and a recommended fix written for the customer’s codebase. A Chainguard appointed engineer reviews and approves each fix and report before delivery.

Only Chainguard staff manages the model, and no one outside of Chainguard can train it or see its raw result, according to the announcement. When the harness finds a flaw in an open source dependency rather than in customer code, Chainguard handles coordinated disclosure with upstream maintainers, and once the upstream issue is resolved, the patched build is shipped via the Chainguard Repository. The release names this disclosure path as Athena, Chainguard’s coordinated vulnerability disclosure process.

First public finding in vLLM

The announcement came a day after Chainguard released the first public discovery of the harness. In an October 13, 2026 research post, the company said the harness discovered a bug in vLLM, an open source engine for serving large language models, in which one client could force another client’s request to be output to a shared engine. The flaw concerned aware_token_ids, a request parameter that limits which tokens the model can generate: upon completion of a request, its row in a shared restriction table was reassigned without clearing the old restriction, so a subsequent request could inherit the previous client’s limits. The bug affected vLLM versions prior to v0.31.0.

Chainguard said it reproduced the exploit three out of three times. The company reported the security impact to vLLM maintainers on September 23, 2026, the fix provided in v0.31.0 on October 2, 2026, and the GHSA-6cxc-2vcg-w5qc advisory was published on October 6, 2026. The bug was present in the vLLM public issue tracker as of May 28, 2026, labeled as a regular bug. vLLM rated the issue as low in severity and the fix consisted of a one-line change plus a related fix, the post said.

According to the post, the vLLM run lasted 10 hours and 48 minutes, processed approximately 115 million tokens, and analyzed 30 parts of the project; 37 candidate results were played on a clean host and 13 withstood technical review. Chainguard said it has audited more than 65 projects and validated more than 680 findings, many of them in coordinated disclosure. The cabling work arose from Chainguard joining Anthropic’s Glasswing project, the post reads.

Beta access and market availability

Chainguard is opening access to a limited group of organizations first. The Harness product page states that the offering is in beta and is a technology preview under Chainguard’s Core Services and License Agreement.

Harness is listed on the Claude Marketplace by Anthropic, where the listing states that customers with an existing Anthropic commitment can apply it through the marketplace’s Request to Purchase path. Chainguard’s release states that Anthropic handles billing, so Anthropic customers can add Harness without a separate procurement process and consolidate their AI spend.

At launch, Chainguard engineers manage Harness on behalf of customers, running it with the open source artifacts that Chainguard already distributes and providing patched builds via the Chainguard Repository, or running it with a customer’s source code and providing an engineer-reviewed report of validated results with severity, impact, replay steps, and recommended fixes.

Daniela Hurtado, Anthropic’s cyber commercial lead, said in the release that models like Mythos 5.1 can surface vulnerabilities that have gone unnoticed for years, and that Harness surrounds the model with isolation, replay and human review so that every discovery is verified before it reaches a customer. Organizations can join the beta waitlist via the Chainguard Harness page.