Anthropic Defending Code Reference Harness: Autonomous Vulnerability Discovery

Anthropic has released the defending-code-reference-harness, an open-source reference implementation designed to automate the discovery and remediation of software vulnerabilities using Claude. The framework establishes a structured pipeline—moving from reconnaissance to patching—that allows security teams to transition from manual static analysis to autonomous, execution-verified vulnerability hunting.

The Autonomous Vulnerability Pipeline

The core of the harness is a multi-stage autonomous pipeline that transforms raw source code into verified patches. While the reference implementation is configured for C/C++ memory vulnerabilities using Docker and AddressSanitizer (ASAN), the architecture is designed to be portable to other languages and vulnerability classes.

Pipeline Stages

Build: The target is compiled into a Docker image. For the reference C/C++ setup, this includes ASAN to detect memory errors.
Recon: A lightweight agent analyzes the source code to propose a partition of the system (e.g., identifying distinct input-parsing subsystems) to ensure parallel agents explore different attack surfaces.
Find: Multiple agents run in parallel within isolated containers, crafting malformed inputs and executing the binary until a crash is consistently reproduced.
Verify: A separate grader agent reproduces the crash in a fresh container using only the proof-of-concept (PoC) provided by the find agent, ensuring the finding is not a fluke of the environment.
Dedupe: A judge agent compares verified crashes against previously reported bugs to eliminate duplicates.
Report: A report agent generates a structured exploitability analysis, detailing the primitive class, reachability, escalation path, and severity.
Patch: A patch agent proposes a fix, which is then validated by a grader agent to ensure the code builds, the original PoC no longer crashes, and existing test suites still pass.

Interactive Security Skills

Beyond the autonomous pipeline, the harness provides a set of interactive "skills" that can be run via Claude Code. These skills are read-and-write only and do not require a sandbox for basic operation:

/threat-model: Bootstraps a threat model for a specific target.
/vuln-scan: Performs a static scan of the source code scoped by the threat model.
/triage: Verifies, dedupes, and ranks static findings.
/patch: Generates candidate fixes for verified findings.
/customize: Assists in porting the reference pipeline to a different language or stack.

Implementation and Security Guardrails

Because the autonomous pipeline executes target code, Anthropic implements strict isolation requirements. The pipeline refuses to run outside of a gVisor sandbox unless explicitly overridden. This setup includes an egress allowlist restricting agents to only communicate with the Claude API, preventing the autonomous agents from accessing the broader network or host system.

Technical Trade-offs and Community Insights

Community discussion highlights several critical considerations for teams implementing AI-driven vulnerability discovery:

Cost and Token Consumption

Running autonomous agents is resource-intensive. Users have reported that the process "burnt A LOT of tokens" to identify specific vulnerabilities, such as SQL injections. Some estimates suggest costs could reach hundreds or thousands of dollars depending on the model used (e.g., Opus vs. Mythos) and the scale of the codebase.

The "Shop Jig" Philosophy

Experienced security researchers suggest that reference harnesses should be treated as "shop jigs"—templates to be studied and then customized.

"Your best bet is to look at something like this for ideas, and then just ask for your own, to fit your own work style, with your own interface... and your own alerting."

The False Positive Challenge

While the pipeline includes a verification stage to reduce false positives, the triage process remains a significant bottleneck. Experts note that without a highly tuned harness, AI tools can result in "vibe auditing," where the volume of false positives overwhelms developers.

Deployment Roadmap

Anthropic recommends a phased approach to adopting the harness:

Day 1: Use interactive skills to build a threat model and run initial static scans.
Day 2: Run the reference pipeline on a known-vulnerable library to understand the loop.
Days 3-5: Customize the pipeline for a specific internal target stack.
Week 2: Scale to autonomous scanning waves, using the /triage skill to collapse duplicates across multiple runs and prioritize patching.