Anthropic's open-source AI framework automates vulnerability discovery and patching

Anthropic has open-sourced its Defending Code Reference Harness, a reference implementation for building AI-powered vulnerability discovery and remediation pipelines using Claude. Based on learnings from the Claude Mythos Preview with enterprise security teams, the harness includes interactive Claude Code skills (quickstart, threat-model, vuln-scan, triage, patch, customize) plus an autonomous pipeline that performs recon → find → verify → report → patch in a gVisor sandbox. The current implementation is optimized for C/C++ memory vulnerabilities, using Docker and AddressSanitizer (ASAN) to find and verify crashes. It is designed to be safe: the interactive skills are read/write only, while the autonomous pipeline refuses to execute target code outside the sandbox unless explicitly overridden.

The repository is not maintained and does not accept contributions, but Anthropic offers a managed alternative: Claude Security, a hosted product that scans repositories, reduces false positives with a multi-stage verification pipeline, and manages findings from triage to fix generation. The open-source harness can also be used with any Claude API access (Bedrock, Vertex, or Azure). Anthropic recommends a four-step ramp-up: day 1 – build a threat model and run static scan/triage; day 2 – run the reference pipeline on a C/C++ library; days 3-5 – customize for the target; week 2 – start autonomous scanning, triage, and patching. This framework enables security teams to rapidly automate vulnerability identification and remediation at scale.