Software delivery platform provider Harness Inc. today launched a set of artificial intelligence agents that find software vulnerabilities and write the patches.

Developers approve the fixes before anything ships. AI SAST runs a deterministic static scanner, then applies an AI layer to strip out noise. Harness said that layer cuts false positives and catches logic flaws such as missing authorization checks, which conventional tools tend to miss entirely.

What survives goes to a Triage Agent, which narrows the pile to findings the software judges exploitable. A Remediation Agent drafts a fix, validates it and opens a pull request against the vulnerable function.

A Zero-Day Agent watches newly disclosed flaws around the clock and flags affected systems across a customer environment, often with a validated fix ready within minutes. Virtual patching blocks exploitation in production until the code fix ships. No code changes are required for it. Customers running their own large language model scanners can also pipe those results into the triage workflow.

Attackers using frontier models can move from a public disclosure to a working exploit in as little as six hours, the company said. The average vulnerability takes more than 50 days to fix. Testing by Harness found frontier models surfacing roughly 10 times more vulnerabilities than conventional scanners. Most security teams have no realistic way to work through that much output, the company argues.

The release invokes “Mythos-class” models, a nod to Claude Mythos Preview. Anthropic PBC has kept that model out of general release because of how well it finds and chains software vulnerabilities. Defenders have had access since April through Project Glasswing.

Co-founder and Chief Executive Jyoti Bansal said attackers are using the same models that help Harness customers ship software quickly. Security has to become “a first-class part of the delivery pipeline itself,” he said. Work currently stalls in handoffs between disconnected scanning, ticketing and deployment systems.

Rahul Sood, general manager of application security at Harness, said the agents all draw on one set of reachability data. That keeps teams off findings that were never exploitable to begin with, he said. The window between discovery and a deployed fix should shrink “from weeks to hours,” he added.

Harness picked up Sood in its September acquisition of Qwiet AI. Qwiet’s Code Property Graph technology underpins the new scanning work. The deal was one piece of an 18-month security buildout at the company. Harness announced a merger with application programming interface security company Traceable Inc. in February 2025. On July 21 it shipped Agent DLC, which audits and governs AI coding agents.

The new agents and virtual patching are available now to Harness customers.

Harness is a venture capital-backed company that last raised $240 million at a $5.5 billion valuation in December.

Image: Harness