anthropics/defending-code-reference-harness

Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize

What it solves

This project provides a reference implementation for autonomously discovering and remediating security vulnerabilities in source code. It aims to reduce the manual effort required for security auditing by automating the loop of reconnaissance, vulnerability finding, verification, reporting, and patching.

How it works

The system uses a multi-stage pipeline powered by Claude to identify bugs and verify them through execution:

  1. Build: Compiles the target code into a Docker image (using ASAN for C/C++ memory error detection).
  2. Recon: An agent analyzes the source to partition the codebase into attackable subsystems.
  3. Find: Parallel agents craft malformed inputs and run the binary until a crash is reproduced.
  4. Verify: A separate grader agent reproduces the crash in a fresh container to confirm the finding.
  5. Dedupe: A judge agent removes duplicate reports.
  6. Report: An agent writes a structured exploitability analysis including severity and reachability.
  7. Patch: A patch agent proposes a fix, which is then verified by a grader to ensure the bug is gone and no regressions were introduced.

For safety, autonomous pipelines execute target code inside a gVisor sandbox with restricted network egress.

Who it’s for

Security teams and developers who want to build their own automated vulnerability discovery pipelines or integrate AI-driven security scanning into their software development lifecycle (SDLC).

Highlights

  • End-to-end automation: Covers the entire lifecycle from threat modeling to patch verification.
  • Execution-verified findings: Moves beyond static analysis by requiring a reproducible crash to confirm a bug.
  • Sandboxed execution: Uses gVisor to isolate the execution of potentially dangerous target code.
  • Customizable framework: While configured for C/C++ by default, the pipeline shape is generic and can be ported to other languages and vulnerability classes.

Related

  • Dispatch
    Anthropic Defending Code Reference Harness: Autonomous Vulnerability Discovery

    Anthropic has released an open-source reference implementation for an autonomous vulnerability discovery and remediation pipeline using Claude, focusing on a recon-find-verify-report-patch loop.

  • Project
    gadievron/raptor

    An autonomous security research framework that automates vulnerability discovery, validation, and patching using a combination of static analysis, binary analysis, and LLMs.

  • Project
    visa/visa-vulnerability-agentic-harness

    An autonomous agentic pipeline for vulnerability discovery, remediation, and validation in source code, designed to reduce the mean time to adapt (MTTA) for security fixes.

  • Project
    hypnguyen1209/offensive-claude

    A spec-driven offensive security framework for Claude Code that implements a structured 9-phase Cyber Kill Chain workflow with executable safety guards and evidence-based verification.