Chainguard builds your application from source, starts it inside an isolated microVM, and lets Anthropic's Claude Mythos 5.1 probe the running copy. Anything the model claims to find then has to happen again, in a fresh environment, before it reaches you.

Harness's distinguishing feature is its verification workflow: it tests running applications, replays candidate exploits in fresh environments, checks proposed fixes against those exploits and requires engineering approval before reporting findings. That can reduce speculative vulnerability reports, although reproducibility alone does not establish severity, exploitability under every production configuration or complete test coverage. Verification itself is not new — penetration testers have always validated what they report. What Chainguard is selling is the integration: frontier-model testing, isolation, replay and human review, run as one managed service for customers who do not have the model themselves.

How a run is contained

The setup matters because the model is being asked to act like an attacker. One model prepares the build, its dependencies and its tooling, then the microVM is suspended. The hunting phase resumes with no network egress and no credentials inside, and the code under test is treated as untrusted data, a guard against instructions hidden in the code itself. The agent loop runs outside the sandbox, so tool calls are logged.

Customers can provide source code through a read-only Chainguard GitHub App connection or an uploaded archive. Chainguard says a separate model prepares the build environment before Mythos 5.1 probes a running copy inside an isolated microVM without network egress or credentials. The agent loop operates outside that sandbox, with tool calls logged, and only Chainguard staff can direct the model or inspect its raw output. Findings in open-source dependencies follow Chainguard's coordinated upstream disclosure process, Athena, and a patched build ships through its repository once the upstream fix lands.

Two limits are worth stating plainly. The no-egress rule covers the hunting phase, not the build phase, when dependencies and tooling are fetched. And the isolation governs what the model can reach while it works — it does not change the fact that customers are handing their source code to Chainguard. That handover is the trust decision; the containment is what is meant to make it acceptable.

Read the totals in two parts

Chainguard says Harness has been run against more than 65 projects and has produced more than 680 validated findings. Treat that as a company total, not an audited one. The breakdown behind it — how many were serious, how many customers have seen, how many are still waiting in disclosure — has not been published.

Chainguard's first public case provides a more inspectable example than its aggregate figures. In a 10-hour, 48-minute run processing approximately 115 million tokens, Harness examined 30 areas of vLLM. Of 37 candidate findings reproduced on a clean host, 13 survived engineering review. One was a cross-client output-manipulation flaw rated Low severity by vLLM's maintainers. The figures demonstrate substantial filtering, but not the cost per confirmed serious vulnerability.

Chainguard did not first discover the underlying bug: another contributor reported it in vLLM's public issue tracker on May 28. Chainguard says its harness independently rediscovered the issue and identified its security implications, which it reported to maintainers on September 23.

What the flaw did is narrower than the phrase cross-client suggests. A restriction from one client's request — its allowed_token_ids list — could persist into a later request on a shared engine, so one client could influence the output another client generated. It did not give the attacker access to the victim's prompt or response, and the attacker could not select a specific victim. The maintainers' advisory records confidentiality and availability as unaffected, and Chainguard itself considered the Low rating reasonable for the bug in isolation. The fix shipped in v0.31.0 on 2 October 2026, and the advisory followed on 6 October.

So the public record currently supports a narrower claim than the launch language: the system can recognize the security implication of a real, if minor, bug that had sat in a public tracker since May labelled as an ordinary bug, and it discards most of what it first suspects before a human signs the report.

What a buyer cannot check yet

At launch the service is operated by Chainguard engineers, either against open source artifacts it already distributes or against a customer's source, with a report as the deliverable. Buying through the Claude Marketplace lets an enterprise apply an existing Anthropic commitment, which simplifies procurement. It does not simplify the comparison that matters.

Chainguard has not published a public price, a self-service trial or an independently audited breakdown of its 680-plus findings. Buyers therefore cannot yet calculate cost per confirmed high-severity vulnerability or compare the service reliably with penetration testing and existing scanners. Reproduction strengthens confidence that a reported behavior is real, but does not eliminate questions about impact, severity, coverage or the quality of a proposed fix.

That comparison is where Harness will either earn its place or not.

Sources

  1. [1] Chainguard announcement via PR Newswire, 14 October 2026 — launch, method, marketplace and beta terms; paraphrased, no long quotationsRead source
  2. [2] Chainguard research post, "The first disclosure from our Mythos harness", 13 October 2026 — the vLLM case: run duration, token count, candidate counts, the May 28 tracker report, disclosure dates and severityRead source
  3. [3] vLLM maintainers' security advisory GHSA-6cxc-2vcg-w5qc — Low severity, CVSS 3.7, fixed in v0.31.0; cross-request output-integrity issue, confidentiality and availability unaffected (independent confirmation)Read source
  4. [4] Unite.AI, "Chainguard Introduces Harness for Frontier-AI Vulnerability Hunting", 14 October 2026 — secondary coverage of the launch and the vLLM caseRead source
  5. [5] SiliconANGLE, 14 October 2026 — secondary coverage of the launch and the reproduction ruleRead source
  6. [6] Help Net Security, 14 October 2026 — secondary coverage of the launchRead source