llms.blog
AI

Harness Ships AI Security Agents to Automate Vulnerability Scanning and Pipeline Remediation

Software delivery platform Harness released a suite of specialized AI security agents designed to automate vulnerability detection, triage, and code remediation directly within continuous integration pipelines. The release targets the growing operational disparity between automated vulnerability discovery and manual patch deployment. According to the Edgescan 2026 Vulnerability Statistics Report, organizations average 55 days to remediate reported software vulnerabilities. Conversely, automated

axc
axc
2 min
Harness Ships AI Security Agents to Automate Vulnerability Scanning and Pipeline Remediation

Software delivery platform Harness released a suite of specialized AI security agents designed to automate vulnerability detection, triage, and code remediation directly within continuous integration pipelines.

The release targets the growing operational disparity between automated vulnerability discovery and manual patch deployment. According to the Edgescan 2026 Vulnerability Statistics Report, organizations average 55 days to remediate reported software vulnerabilities. Conversely, automated offensive tooling tracked by security monitors can generate functional exploits within six hours of public disclosure.

Harness AI SAST and Automated Remediation Architecture

Hybrid Scanning Architecture

To address the high false-positive rates typical of purely generative code scanners, Harness structured its AI SAST engine as a hybrid system. The platform pairs a deterministic dataflow analysis engine with a secondary machine learning classification layer.

The classification layer evaluates identified flaws into three tiers: confirmed risk, potential risk, or contextually safe. In benchmark evaluations conducted against the OWASP Java corpus, Harness reported that this filtering reduced false positives by 79 percent (from 454 to 95 instances) while increasing overall precision from 74 percent to 93 percent at 91 percent recall. For insecure direct object reference (IDOR) vulnerabilities across Java, Python, and Go codebases, the system demonstrated 71 percent recall and 99 percent precision.

The hybrid architecture avoids non-deterministic CI gating by relying on deterministic analysis for build checks, while reserving probabilistic LLM sweeps for targeted security audits.

Reachability Triage and Automated Remediation

Downstream from the scanning layer, the platform deploys specialized agents across distinct remediation stages:

  • Triage Agent: Combines Common Vulnerability Scoring System (CVSS) metrics and Exploit Prediction Scoring System (EPSS) data with static call-graph reachability. Dependencies are only flagged as active blockers if vulnerable functions are executed within the application path.
  • Remediation Agent: Generates code patches to resolve identified vulnerabilities, runs the updated codebase against existing test suites in the CI pipeline, and submits pull requests for developer review.
  • Zero-Day Agent: Scans internal application inventories when new Common Vulnerabilities and Exposures (CVEs) are published, identifies affected artifacts across deployment pipelines, and prepares remediation pull requests automatically.
  • Virtual Patching Layer: Deploys temporary filtering rules at the web application and API protection (WAAP) gateway level to block incoming exploit payloads while underlying codebase patches undergo review and testing.

Pipeline Integration and Guardrails

The deployment framework enforces human-in-the-loop controls for all code modifications. While agents automate artifact discovery, blast-radius mapping, and patch synthesis, pull request merge authority remains restricted to authorized engineering personnel.

The announcement follows previous enterprise integrations by Harness, including the acquisition of API security firm Traceable and runtime governance controls developed for the Kong AI Gateway ecosystem.

Sources

AICybersecurityAppSecSoftware Engineering
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Token Healing and Partial Token Alignment in Production LLM Serving: Architecture, Prefix Trie Rollback, and Serving Trade-Offs

    Modern large language models operate on discrete subword tokens generated by greedy compression algorithms like Byte-Pair Encoding (BPE), WordPiece, or Unigram. While subword tokenization enables high compression rates and fixed vocabulary sizes, it introduces a structural defect at the interface between raw user text and autoregressive inference: the partial token problem, commonly known as the prompt boundary problem. When a user prompt terminates mid-token or at a punctuation boundary that c

    1 min

  • Flow Matching for Generative Modeling: How Continuous Normalizing Flows and Optimal Transport Paths Replace Diffusion SDEs

    Flow Matching for Generative Modeling: How Continuous Normalizing Flows and Optimal Transport Paths Replace Diffusion SDEs Generative modeling underwent a structural shift with the introduction of Flow Matching (FM), formulated independently by Lipman et al. (2022), Albergo and Vanden-Eijnden (2022), and Liu et al. (2022). While Denoising Diffusion Probabilistic Models (DDPM) and score-based Stochastic Differential Equations (SDEs) established state-of-the-art sample quality across vision and a

    1 min

  • Retrieval-Augmented Fine-Tuning (RAFT) in Production: Architecture, Synthetic Distractor Pipelines, and Evaluation

    Standard approaches to enterprise domain adaptation typically force a choice between two paradigms: Supervised Fine-Tuning (SFT) or Retrieval-Augmented Generation (RAG). SFT bakes domain knowledge directly into model weights, functioning like a closed-book exam. When facts change or precise source attribution is required, SFT models often hallucinate or fail to incorporate updated context. Conversely, standard RAG operates like an open-book exam without prior preparation. The base model reads re

    1 min