Chainguard on October 14, 2026 introduced Chainguard Harness, an offering that uses Anthropic’s Claude Mythos 5.1 to hunt exploitable vulnerabilities in a live, isolated build of an organization’s application and deliver each verified finding with a recommended fix. The company opened a beta waitlist the same day and made the offering purchasable through the Claude Marketplace by Anthropic.
In its announcement, Chainguard said frontier models that perform vulnerability discovery across first-party and open source code have so far been mostly available to a select group of organizations doing defensive security work for critical infrastructure. The company said Harness brings that capability to organizations that lack frontier-model access or the security and engineering expertise to run it themselves.
CEO and co-founder Dan Lorenc said in the company’s release: “Every time we’ve pointed Harness at code, it has found serious, exploitable vulnerabilities, including in software that’s been scanned many times over and code that runs critical infrastructure.” He said Harness offers security teams another option to get proven vulnerabilities and fixes their engineers can ship.
How the Harness Works
Chainguard’s announcement describes a five-step process. Customers connect repositories through the Chainguard GitHub App with read-only access, or upload a source archive. Harness builds the application from source exactly as it would ship to production and boots it inside an isolated microVM. Mythos 5.1 then probes the running application for logic flaws, injection, and resource exhaustion, working from the source code, git history, dependency source, and build configuration while watching how the live application responds.
Containment runs in two phases. In a setup phase, a separate model builds the application, fetches its dependencies and tooling, and gets it running inside the microVM, which is then suspended. In the hunting phase, the microVM resumes for Mythos 5.1 with no network egress and no credentials inside, and the model works only with a shell and packages built by Chainguard. The agent loop runs outside the sandbox, so every tool call and command the model issues is logged. The code under test is treated as untrusted data, which the company said guards against prompt injection hidden in the code being analyzed.
Every exploit is replayed in a fresh microVM, and a finding that does not land every time does not make the report. Each recommended fix is verified the same way: the exploit must succeed against the customer’s current code and fail against the fix. The delivered report contains an executive summary, each finding’s severity and impact, steps to confirm the finding, and a recommended fix written for the customer’s codebase. A named Chainguard engineer reviews and approves every fix and report before delivery.
Only Chainguard staff operate the model, and no one outside Chainguard can instruct it or see its raw output, according to the announcement. When the harness finds a flaw in an open source dependency rather than in customer code, Chainguard handles coordinated disclosure with upstream maintainers, and once the issue is resolved upstream the patched build ships through Chainguard Repository. The release names that disclosure route as Athena, Chainguard’s coordinated vulnerability disclosure process.
First Public Finding in vLLM
The announcement came one day after Chainguard published the first public finding from the harness. In an October 13, 2026 research post, the company said the harness found a bug in vLLM, an open source engine for serving large language models, in which one client could force the output of another client’s request on a shared engine. The flaw involved allowed_token_ids, a request parameter that restricts which tokens the model may generate: when a request finished, its row in a shared restriction table was reassigned without clearing the old restriction, so a later request could inherit the previous client’s limits. The bug affected vLLM versions before v0.31.0.
Chainguard said it reproduced the exploit three out of three times. The company reported the security impact to vLLM’s maintainers on September 23, 2026, the fix shipped in v0.31.0 on October 2, 2026, and the advisory GHSA-6cxc-2vcg-w5qc was published on October 6, 2026. The bug had been sitting in vLLM’s public issue tracker since May 28, 2026, labeled as an ordinary bug. vLLM rated the issue Low severity, and the fix was a one-line change plus a related fix, the post said.
According to the post, the vLLM run lasted 10 hours and 48 minutes, processed about 115 million tokens, and probed 30 parts of the project; 37 candidate findings reproduced on a clean host, and 13 held up to engineering review. Chainguard said it has run the harness against more than 65 projects and validated more than 680 findings, with a number of them in coordinated disclosure. The harness work grew out of Chainguard joining Anthropic’s Project Glasswing, the post said.
Beta Access and Marketplace Availability
Chainguard is opening access to a limited group of organizations first. The Harness product page states the offering is in beta and is a Technology Preview under Chainguard’s Master Services and License Agreement.
Harness is listed on the Claude Marketplace by Anthropic, where the listing states that customers with an existing Anthropic commitment can apply it through the marketplace’s request-to-buy path. Chainguard’s release states that Anthropic manages invoicing, so Anthropic customers can add Harness without a separate procurement process and consolidate their AI spend.
At launch, Chainguard engineers operate Harness on behalf of customers, either by running it against the open source artifacts Chainguard already distributes and delivering patched builds through Chainguard Repository, or by running it against a customer’s source code and delivering an engineer-reviewed report of validated findings with severity, impact, reproduction steps, and recommended remediation.
Daniela Hurtado, Anthropic’s head of commercial cyber, said in the release that models like Mythos 5.1 can surface vulnerabilities that have gone unnoticed for years, and that Harness surrounds the model with isolation, reproduction, and human review so every finding is verified before it reaches a customer. Organizations can join the beta waitlist through Chainguard’s Harness page.