Anthropic’s Defending Code Harness: AI Vulnerability Scanning

Anthropic open-sourced its Defending Code Reference Harness, an autonomous vulnerability scanning pipeline that has already disclosed 1,596 vulnerabilities in open-source software, with only 97 patched so far. The pipeline, which runs on Claude Code and includes threat modeling, sandboxed proof-of-concept execution, deduplication, and patch generation, cuts non-exploitable results by roughly 50% through an independent adversarial verification stage. Anthropic estimates the tool would cost approximately $2.5 million annually for a 100-developer organization at current API rates.

Anthropic quietly open-sourced a complete autonomous vulnerability scanning pipeline, and it has already disclosed 1,596 vulnerabilities in open-source software — with only 97 patched so far. The Defending Code Reference Harness https://github.com/anthropics/defending-code-reference-harness gives any development team the same pipeline Anthropic uses internally: threat modeling, sandboxed proof-of-concept execution, deduplication, and patch generation, all wired into Claude Code as runnable skills. It sits at 6.7k GitHub stars. Anthropic ships it as a reference implementation, not a product — which means you adapt it rather than just install it. The Bottleneck Has Moved Here is the thing worth understanding before you run your first scan: finding vulnerabilities is no longer the hard part. Spawning parallel discovery agents is cheap. What breaks teams is everything that comes after — verification, deduplication, and actually patching what you find. As Anthropic’s own documentation states, “the bottleneck has shifted to verification, triage, and patching.” This is why most security scanning tools disappoint in practice. You run a SAST tool, get 300 findings, and your AppSec team spends the next two weeks determining that 250 of them are not exploitable. The harness fixes this structurally: its verification stage uses an independent adversarial agent — with no shared history from the discovery run — specifically tasked with disproving findings. That alone cuts non-exploitable results by roughly 50%. Requiring proof-of-concept execution brings the false positive rate to near zero. How the Pipeline Works The harness runs through six stages: threat modeling, sandboxing, discovery, verification, triage, and patching. On day one, you work interactively with Claude Code skills: git clone https://github.com/anthropics/defending-code-reference-harness cd defending-code-reference-harness claude /quickstart /threat-model bootstrap targets/canary /vuln-scan targets/canary /triage targets/canary/VULN-FINDINGS.json /patch ./TRIAGE.json --repo targets/canary The interactive skills — /quickstart , /threat-model , /vuln-scan , /triage , and /patch — are safe to run without a sandbox. The autonomous pipeline that runs the full loop unattended requires gVisor isolation, which prevents agents from touching anything outside the sandboxed container. Run ./scripts/setup sandbox.sh followed by bin/vp-sandboxed to start a headless scan. The triage step rates severity on six factors: reachability from a real entry point, whether untrusted input reaches the sink intact, preconditions required, authentication level, read versus write impact, and blast radius. The severity ladder starts at critical for zero-precondition unauthenticated remote access and drops to low for anything requiring three or more preconditions or limited to local access. One team using the harness cleared a backlog of hundreds of stale findings in a few days by applying this rubric to existing reports. Patching follows a test-driven approach: write a failing test that reproduces the exploit, implement the fix, verify the original PoC no longer triggers the crash, then run an adversarial agent to confirm no variant was missed. A developer testing the tool on Hacker News reported it correctly identified a SQL injection allowing cross-tenant data access via Snowflake — a finding that would be difficult to catch with pure static analysis. What It Costs to Run Token consumption per agent sits at roughly 10,000 uncached input tokens per minute and 2,000 output tokens per minute. For a large codebase with parallel agents, costs accumulate fast — Anthropic estimates approximately $2.5 million annually for a 100-developer organization at current API rates. Most teams will run targeted scans on high-risk components rather than whole-codebase sweeps. That is the right approach anyway: first scans surface the bulk of findings, and subsequent runs find progressively more complex bugs. The harness defaults to C and C++ with ASAN-based crash detection https://github.com/google/sanitizers/wiki/AddressSanitizer . The /customize skill handles adaptation to Java, Python, and Go, though the memory-safety crash oracle does not directly translate to interpreted languages. Self-Hosted vs. Managed If you want to skip the infrastructure work, Anthropic launched Claude Security https://www.anthropic.com/product/security in public beta on May 1, 2026. It runs on Claude Opus 4.7, requires no API integration, supports scheduled scans, and is available at claude.ai/security for Claude Enterprise customers. Team and Max plan support is coming. For teams that want open-source alternatives, the ecosystem has expanded. Semgrep maintains its own fork of the harness https://github.com/semgrep/defending-code-harness — actively maintained and accepting contributions, unlike Anthropic’s reference repo. Trail of Bits released a skills package with 40 plugins distilling security consultant knowledge. Cloudflare’s security-audit-skill adds adversarial validation in a six-phase pipeline. Capital One’s VulnHunter offers a simpler three-skill composable loop: find, fix, verify. None of these execute target binaries for crash verification the way Anthropic’s harness does — that execution-verified patching remains its key differentiator. What to Do With This Today The harness is explicitly not a turnkey product. Anthropic marks the repo as not accepting contributions and frames it as a reference to adapt. The official documentation https://github.com/anthropics/defending-code-reference-harness/blob/main/docs/blog-post.md walks through every design decision in detail, including why simple non-prescriptive prompts outperform detailed checklists for discovery — checklists constrain model creativity on novel vulnerability patterns. The fastest path to value: clone the repo, run /quickstart against a non-production C/C++ library, and spend time on the threat model before anything else. Teams that defined clear threat models upfront found 90% of their scanner findings to be genuinely exploitable. Teams that skipped that step got the opposite: technically real findings with zero practical impact. AI-powered vulnerability discovery at scale is only as useful as the verification and triage pipeline downstream of it.