Software delivery platform Harness released a suite of specialized AI security agents designed to automate vulnerability detection, triage, and code remediation directly within continuous integration pipelines.
The release targets the growing operational disparity between automated vulnerability discovery and manual patch deployment. According to the Edgescan 2026 Vulnerability Statistics Report, organizations average 55 days to remediate reported software vulnerabilities. Conversely, automated offensive tooling tracked by security monitors can generate functional exploits within six hours of public disclosure.
Hybrid Scanning Architecture
To address the high false-positive rates typical of purely generative code scanners, Harness structured its AI SAST engine as a hybrid system. The platform pairs a deterministic dataflow analysis engine with a secondary machine learning classification layer.
The classification layer evaluates identified flaws into three tiers: confirmed risk, potential risk, or contextually safe. In benchmark evaluations conducted against the OWASP Java corpus, Harness reported that this filtering reduced false positives by 79 percent (from 454 to 95 instances) while increasing overall precision from 74 percent to 93 percent at 91 percent recall. For insecure direct object reference (IDOR) vulnerabilities across Java, Python, and Go codebases, the system demonstrated 71 percent recall and 99 percent precision.
The hybrid architecture avoids non-deterministic CI gating by relying on deterministic analysis for build checks, while reserving probabilistic LLM sweeps for targeted security audits.
Reachability Triage and Automated Remediation
Downstream from the scanning layer, the platform deploys specialized agents across distinct remediation stages:
- Triage Agent: Combines Common Vulnerability Scoring System (CVSS) metrics and Exploit Prediction Scoring System (EPSS) data with static call-graph reachability. Dependencies are only flagged as active blockers if vulnerable functions are executed within the application path.
- Remediation Agent: Generates code patches to resolve identified vulnerabilities, runs the updated codebase against existing test suites in the CI pipeline, and submits pull requests for developer review.
- Zero-Day Agent: Scans internal application inventories when new Common Vulnerabilities and Exposures (CVEs) are published, identifies affected artifacts across deployment pipelines, and prepares remediation pull requests automatically.
- Virtual Patching Layer: Deploys temporary filtering rules at the web application and API protection (WAAP) gateway level to block incoming exploit payloads while underlying codebase patches undergo review and testing.
Pipeline Integration and Guardrails
The deployment framework enforces human-in-the-loop controls for all code modifications. While agents automate artifact discovery, blast-radius mapping, and patch synthesis, pull request merge authority remains restricted to authorized engineering personnel.
The announcement follows previous enterprise integrations by Harness, including the acquisition of API security firm Traceable and runtime governance controls developed for the Kong AI Gateway ecosystem.
