Harness Launches AI Agents to Automate Code Patching

On August 19, 2026, software-delivery platform Harness released a suite of AI security agents—including AI SAST, agentic triage and remediation, a Zero-Day Agent, and virtual patching. The launch targets a massive defensive gap: while attackers can exploit vulnerabilities in as little as six hours, defenders take an average of 55 days to remediate them, according to the Edgescan 2026 Vulnerability Statistics Report. Even after a fix is written, the 2025 DORA Report indicates that moving a commit to production typically takes over a week.

While frontier models like the Claude Mythos Preview used in Anthropic's Project Glasswing can surface ten times more vulnerabilities, they also create backlogs. For instance, Comcast found that 44 percent of its high- and critical-severity LLM findings were false positives, with only 36 percent of critical and 33 percent of high-severity findings confirmed exploitable. To combat this, Harness's AI SAST pairs a deterministic dataflow engine with an AI confidence layer. In benchmarks against the OWASP Java corpus, this cut false positives by 79 percent (from 454 to 95), boosting precision from 74 percent to 93 percent with 91 percent recall. On a 390-case Go, Java, and Python corpus testing insecure direct object reference, it achieved 71 percent recall at 99 percent precision.

For practitioners, the suite automates the tedious work of sorting and fixing bugs. The Triage Agent prioritizes issues using CVSS, EPSS, and reachability analysis to ensure a dependency is flagged only if the vulnerable function is actually called. The Remediation Agent then drafts a fix, validates it, and opens a pull request. To handle immediate threats, the Zero-Day Agent maps an exploit's blast radius in seconds rather than days, while virtual patching deploys temporary protective rules to shield production within minutes.

This release builds on Harness's security expansion, including its February 2025 merger with Traceable under Sanjay Nagaraj and the July 2026 launch of Agent DLC. To prevent issues like the shell injection vulnerability introduced by Copilot Autofix in Snowflake's pipeline, Harness enforces strict governance where agents propose fixes but humans retain merge authority. Rahul Sood, Harness's general manager of application security, noted that the goal is "to make security a first-class part of the delivery pipeline itself."