Vulnerabilities used to move at human speed. A researcher found one, disclosed it, and defenders had days - sometimes weeks - to respond before it was weaponized in the wild.

That window is gone. According to the Edgescan 2026 Vulnerability Statistics Report, it still takes an average of 55 days to fix a vulnerability - but the Zero Day Clock shows attackers going from disclosure to first exploit in as little as 6 hours. And per the 2025 DORA Report, once a fix is written, it can still take more than a week to get from commit to production. Security teams are trying to close a gap measured in hours with a process measured in weeks.

Frontier models like Claude Mythos are pulling on both ends of that gap at once. On one side, they're giving attackers a faster way to find and chain vulnerabilities. On the other, they're giving defenders a faster way to find vulnerabilities too. Point an LLM scanner at a codebase and it will surface far more findings than traditional tools ever did. Project Glasswing partners saw roughly 10x more vulnerabilities surfaced during testing. That's a good thing only for visibility. But it creates an operationalization challenge. Without any normalization, deduplication, reachability or integration with developer workflow, it just creates more backlog for a remediation process that was already too slow. Comcast, a Project Glasswing participant, put a number on that gap in its own testing: 44% of critical- and high-severity findings turned out to be false positives.

Security has to move at machine speed now, end to end: scan without drowning in noise or cost, triage what's actually worth fixing, remediate it, get the fix into production before the window closes, and still protect the perimeter while the fix is fully deployed. That's what this launch is about.

Scan without the guesswork: AI SAST and LLM Scan Orchestration

Everything downstream starts with the scan, so that's where machine speed has to start too.

LLM-based scanners are genuinely good at finding things traditional static analysis misses, which is exactly why they've generated so much attention. But they're still probabilistic: point the same model at the same code twice and you can get different findings, different false positives, latency that can hold up pipelines, and a token bill that scales with every file you scan. That's a real cost, and it makes it unrealistic to scan continuously in CI/CD. 

That’s why Harness is embracing the hybrid approach - use LLMs for one-off hunting scans, and a deterministic SAST augmented by AI in the pipeline.

AI SAST 

Harness pairs a high-recall dataflow engine with an AI confidence layer that classifies each finding as confirmed risk, potential risk, or contextually safe. It's deterministic where LLM scanning is probabilistic: same code, same result, every time, with a traceable path from input to sink. In our own benchmarking against the OWASP Java corpus, that confidence layer cut false positives by 79% (from 454 down to 95) and lifted precision from 74% to 93%, while preserving 91% recall - almost no loss of signal for a large gain in precision. It also extends into broken access control (IDOR), a class dataflow analysis alone can't see because there's no malformed input to pattern-match, only a missing authorization check: 71% recall at 99% precision across a 390-case corpus spanning Go, Java, and Python.

LLM Scan Orchestration 

For teams that want to run LLM-based scanners, Harness now orchestrates them natively inside the CI/CD pipeline, reducing token spend, increasing scan speed, and feeding results into the same triage and remediation workflow as everything else - instead of a separate spreadsheet living outside your pipeline.

Which should you choose? AI SAST reduced the triage queue by 21% in our benchmark (1,746 flagged cases down to 1,381 actionable ones) without giving up coverage, and without paying a per-scan LLM bill to get there. LLM scanners still have a place, and Harness will keep making them faster and cheaper to run. But when the choice is between a probabilistic result and a deterministic one at comparable or better accuracy, the deterministic one should usually win by default.

From finding to fix: Triage Agent and Remediation Agent

A scanner - any scanner - is only useful if what it finds actually gets fixed. And the steady output of SAST and SCA scanning has a particular shape: a high volume of findings that need to be sorted by real risk before anyone starts fixing, because most security teams already have more open findings than they can act on in a sprint, let alone a day. And most of that backlog isn't as urgent as it looks: in the same Project Glasswing testing, only 36% of critical-severity and 33% of high-severity findings were confirmed exploitable. Sorting through that backlog by hand, then writing and validating each fix one by one, is exactly the kind of toil that doesn't scale with the volume scanning produces, so Harness is introducing an agentic workflow that does.

Triage Agent 

Harness’s Triage Agent prioritizes what's actually exploitable, combining CVSS, EPSS, and reachability analysis to cut a sprawling SAST/SCA finding list down to a clean, actionable backlog - so your team works on real risk, not everything with a CVE number.

Remediation Agent 

Once a finding is prioritized, the Remediation Agent applies the fix and validates it in your pipeline to prevent breaking builds, then opens a human-reviewed pull request. Developers stay in charge of what merges; the agent just does the work of getting them a validated fix instead of a bare finding.

Function-level reachability 

Reachability analysis doesn't stop at "is this vulnerable package called." Harness now traces the call path down to the specific vulnerable function, so a dependency only gets flagged if that exact function is reachable in your code. Both agents work off that sharper signal: fewer false positives for Triage Agent, and a precise code path to close for Remediation Agent.

Because these agents run on top of Harness's existing pipeline governance (policy gates, approvals, chain of custody), a fix doesn't just get written faster, it gets safely into production faster too. That's the piece that's easy to overlook: a fix sitting in a pull request isn't protection. A fix that's deployed with an audit trail through the same governed pipeline you already trust - that's protection.

Zero-days don't wait in line: Zero-Day Agent

Everything above assumes there's time to scan, triage, and prioritize before anyone acts. A zero-day doesn't give you that time. The clock starts the moment it's disclosed, and most of that time doesn't get spent writing a fix - it gets spent figuring out if you're even affected and waiting for a fixed artifact to work its way back through build, test, and deploy.

A newly disclosed zero-day doesn't need to wait in a triage queue behind the rest of the backlog; it needs an immediate, end-to-end response. Zero-Day Agent runs that response itself: it continuously monitors for newly disclosed zero-day vulnerabilities, automatically identifies every affected artifact and pipeline across your environment, and takes it the rest of the way - applying and validating a fix, then opening a human-reviewed pull request. No separate triage step, no handoff to another agent. Blast radius mapping that used to take days happens in seconds, and a fix is ready for review shortly after.

Shielding production while the fix is in flight

Even with agents compressing the fix cycle to hours, hours are still a window. Harness closes that window from the other direction with virtual patching: when API testing discovers a vulnerability, it can create a virtual patch and deploy it on our WAAP - no tickets or code changes required. Production is shielded within minutes of discovery, while the permanent fix is worked in code. When the fix ships, the virtual patch comes down.

That's the same principle running through this whole launch: don't wait for the slowest step in the chain to gate every other step. Contain the risk immediately, fix it in parallel, and let each part of the system move as fast as it's capable of moving.

Security at machine speed

None of this works as a single point tool. The value comes from AI SAST, LLM scan orchestration, Triage Agent, Remediation Agent, Zero-Day Agent, and virtual patching all sitting on the same platform - the same one that's already deploying your code, governing your pipelines, and holding chain of custody on every artifact. Finding a vulnerability faster only matters if fixing it and deploying it are just as fast.

The organizations that build this operating rhythm now, those that scan without noise, triage in minutes, ship a validated fix in hours, shield production the whole time, will be the ones still moving confidently when attackers have the same frontier models defenders do. The ones that don't will keep measuring their response time in weeks while the threat measures its head start in hours.

Want to learn more?

Read about Harness's perspective on how Mythos is not just a security problem, but also an engineering problem. To learn more about the security capabilities in this launch, request a demo or reach out to your Harness account rep.