.png)
Harness AI is starting 2026 by doubling down on what it does best: applying intelligent automation to the hardest “after code” problems, incidents, security, and test setup, with three new AI-powered capabilities. These updates continue the same theme as December: move faster, keep control, and let AI handle more of the tedious, error-prone work in your delivery and security pipelines.
What’s New in Harness AI:
- Human-aware incident analysis that correlates conversations with changes
- AI-driven API naming that reduces security noise
- Natural-language auth script generation for faster AST onboarding
- AppSec agent for querying security data and generating policies
Human-Aware Change Agent for AI SRE
Harness AI SRE now includes the Human-Aware Change Agent, an AI system that treats human insight as first-class operational data and connects it to the changes that actually break production. Instead of relying only on logs and metrics, it listens to real incident conversations in tools like Slack, Teams, and Zoom and turns those clues into structured signals.
- The AI Scribe captures key decisions, timestamps, symptoms, and “right before this happened…” moments from live conversations, filtering out unrelated chatter.
- The Change Agent uses these human signals to drive a change-centric investigation across deployments, feature flags, config, infra changes, and ITSM records, then produces evidence-backed hypotheses such as, “This checkout deployment changed retry behavior 12 minutes before the incident, and latency spiked immediately after.”
By unifying human observations with the software delivery knowledge graph and change intelligence, teams get a much faster path from “what are we seeing?” to “what changed?” to “what should we roll back or fix safely?” The result is shorter incidents, clearer ownership, and a teammate-like AI that reasons about both people and systems in real time. Learn more in the announcement blog post.
AI-Powered API Naming for Cleaner Security Signals
Effective application security starts with knowing what you actually have in production. Traditional API naming based on regex heuristics often leads to over-merged or under-merged API groups, noisy inventories, and false positives across detection workflows.
This month, API naming in our Traceable product gets a major upgrade with AI-powered API semantics:
- API naming is now powered by LLMs that understand intent, behavior, and functional semantics, not just URL or path similarity. The result is more stable, meaningful API groupings that reflect how your services actually behave.
- The LLM-driven results were baselined against custom naming rules from advanced users and achieved >98.7% average match in internal benchmarking.
- With cleaner API groupings, teams see reduced false positives across vulnerability detection, AST, and runtime protection, and a less noisy API inventory that’s easier for security and platform teams to act on.
For security leaders trying to tame API sprawl, this is a foundational improvement that boosts signal quality across the entire platform.
AI-Based Auth Script Generation: Faster, Safer API Security Testing Setup
Authentication setup has been one of the most consistent sources of friction for application security testing. Manual scripting, validation cycles, and back-and-forths often create bottlenecks — and a broken auth script can quietly invalidate an entire scan run.
To solve this, all API Security Testing customers now get AI-based Authentication Script Generation:
- Generate auth scripts by simply describing the scenario in natural language; AI produces a ready-to-use script in a few seconds, which you can refine, edit, or use as a base for existing scripts.
- The feature works alongside existing flows, so teams can keep using form-based or code-based auth with identical behavior while layering in AI where it helps most.
The result is less time lost to brittle auth setup, faster onboarding for new apps, and fewer failed scans due to script errors.
You can find implementation details and examples in the docs.
Chat with AppSec Agent: Security Data, in Plain Language
Security and platform teams often know the question they want to ask: “Where is this component used?” “Which exemptions are still pending?” , but answering it requires hopping across dashboards and stitching together filters by hand.
The new AppSec Agent makes this dramatically easier by letting you query AppSec data using natural language.
Here's what it does:
- In Harness STO, you can ask about security issues and exemptions, then drill into issue-level insights from STO results without manually navigating views or composing complex filters. Questions like “Approve all valid pending exemptions in this project of issue type secret” become a single prompt instead of a multi-step workflow.
- In Harness SCS, you can query for artifacts, code repos, SBOMs, chain-of-custody, and compliance results, then even generate OPA policies with a single prompt to block components based on license risk or vulnerable packages. For example, “Create an OPA policy to block the deployment of components licensed under the GPL-3.0 license” or “Help me identify whether the chalk and xz-utils components are present in any of the artifacts in this project” are fully supported.
- The AppSec Agent is available across all production environments and integrates directly with Harness Security Testing Orchestration (STO) and Software Supply Chain Assurance (SCS).
This is a big step toward making AppSec data as queryable and collaborative as the rest of your engineering stack. Learn more in the docs.
How This Fits the Harness AI Vision
Harness AI is focused on everything after code is written — building, testing, deploying, securing, and optimizing software through intelligent automation and agentic workflows. January’s updates extend that vision across:
- Security and AppSec: higher-fidelity API grouping, fewer false positives, and faster AST onboarding with AI-generated auth.
- SRE and Operations: human-aware incident response that unifies human and machine signals into a single, change-driven flow.
- Governance and Compliance: consistent with December’s AI governance updates, all of these capabilities inherit Harness’s approach of policy-aware AI, auditability, and RBAC-aligned actions.
Teams adopting these features can ship changes faster, investigate less, and focus more of their time on the work that actually moves the business — while Harness AI quietly handles the complexity in the background.
All this author’s posts
Chinmay's expertise centers on making complex technologies - such as cloud-native solutions, Kubernetes, application security, and CI/CD pipelines - accessible and engaging for both developers and business decision-makers. His professional background includes roles as a software engineer, developer advocate, and technical marketing engineer at companies such as Intel, IBM, Semgrep, and Epsagon (later acquired by Cisco). He is also the co-author of “AI Native Software Delivery” (O’Reilly).
