Anthropic's Open Source Framework for AI-Powered Vulnerability Detection

Anthropic has released the Defending Code Reference Harness, which uses Claude to autonomously detect and resolve vulnerabilities.

This framework is a reference implementation of an agentic workflow that flows through recon → find → triage → report → patch. Developers can use it to build their own vulnerability detection pipelines, or customize the logic for specific languages and detection tools.

Key features include:

• Autonomous workflow: Automates the entire process from vulnerability detection to patch generation using Claude.
• Customizable: Can be extended to other languages like Java or various vulnerability classes using the provided guide.
• Security-focused design: Since the process involves executing target code, running it within a gVisor sandbox environment is strongly recommended.

Separate from this open source project, Anthropic also offers Claude Security, a managed product that lets enterprises scan entire code repositories and manage the vulnerability lifecycle.