The report
Chainguard announced the beta of Harness, a managed application-vulnerability testing service using Claude Mythos 5.1. Customers authorize read-only repository access or upload source. The company then builds the application in an isolated microVM, tests running behavior and reruns candidate exploits in a fresh environment before including them in a report. Recommendations and reproductions receive human engineering review.
Chainguard describes a separate setup phase and a hunting phase with neither outbound network access nor customer secrets in the execution VM. The orchestration loop remains outside the sandbox, where issued commands are observable. These are architectural claims from the provider, not an independent penetration-test certificate. The service is in limited beta, and no reproducible public detection-rate, cost-per-finding or false-positive benchmark establishes its real-world effectiveness.
The separately disclosed vLLM cross-request integrity flaw illustrates a concrete research output. It does not verify every product claim about the commercial service.
Like the AI-assisted Chrome research, this release concerns obtaining and validating exploit evidence. They are independent projects; the new service announcement is not a measured detection or exploit-success result.
What a reproducible finding would contain
A useful external assessment of this service would distinguish source-only candidates from exploits actually replayed against the rebuilt application. The described microVM and fresh-environment replay are intended to reduce the risk of declaring a vulnerability on a single speculative model response. Human review provides another check, but neither step yields a measured false-positive rate without an independently known vulnerability set. The isolated hunting VM also does not describe every trust boundary in the wider orchestration service, especially where customers submit source code and receive reports.
The disclosed serving-state integrity defect is one concrete output from the research program. It demonstrates that a candidate can be tied to a specific implementation behavior; it does not prove a detection rate for unrelated applications. The launch remains a product and research-process announcement, not a security certification.