{"id":22840329,"date":"2026-10-14T01:00:00","date_gmt":"2026-10-14T05:00:00","guid":{"rendered":"https:\/\/thenewstack.io\/?p=22840329"},"modified":"2026-10-14T07:48:47","modified_gmt":"2026-10-14T11:48:47","slug":"chainguard-mythos-security-harness","status":"publish","type":"post","link":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/","title":{"rendered":"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out"},"content":{"rendered":"\n

Chainguard has launched an AI-powered security harness that uses frontier models<\/strong>, including Anthropic’s restricted Claude Mythos 5.1, to find and fix exploitable vulnerabilities in application code that conventional scanners miss.<\/p>\n\n\n\n

Developers can use Chainguard Harness without direct access to Mythos because Chainguard originally built the tool for its own work with the model as part of Project Glasswing, and the company plans to open Harness up to other frontier models over time rather than keep it tied to a single one.<\/p>\n\n\n\n

The company tells The New Stack<\/em> that Harness has found serious vulnerabilities in codebases that had already undergone extensive security scanning, including software used in critical infrastructure. The first of those findings to go public is a now-patched flaw in vLLM, the open source inference engine, while the critical infrastructure bugs remain under wraps as Chainguard coordinates fixes with upstream maintainers.<\/p>\n\n\n\n

Announced Wednesday, Harness leads a four-product launch alongside Workspaces, Checks, and expanded Libraries protections, extending Chainguard’s reach beyond hardened container images and dependencies into agent execution environments and CI verification.<\/p>\n\n\n\n

Mythos access without Glasswing<\/h2>\n\n\n\n

Anthropic has restricted Claude Mythos 5.1 access to organizations participating in Project Glasswing<\/a>, which puts Chainguard in the position of running Mythos-powered vulnerability research for customers who couldn’t otherwise touch the model.<\/p>\n\n\n\n

“We first built Chainguard Harness for our own use of Claude Mythos as part of Project Glasswing,” Chainguard tells The New Stack<\/em>, adding that Harness “runs on Claude Mythos 5.1 to start, but our goal is for Harness to be model-agnostic, always aligned with frontier AI.”<\/p>\n\n\n\n

Harness will also be available through Anthropic’s Claude Marketplace, allowing teams to use existing Anthropic spending commitments rather than secure a separate budget.<\/p>\n\n\n\n

\n

“We first built Chainguard Harness for our own use of Claude Mythos as part of Project Glasswing.”<\/p>\n<\/blockquote>\n\n\n\n

Validating vulnerabilities in vLLM<\/h2>\n\n\n\n

Chainguard’s first public disclosure from Harness<\/a> targets vLLM, an open source engine that many teams rely on to serve large language models. In versions before v0.31.0, one client could force the output returned to other clients sharing the same engine, and the tampered response came back looking like a normal, successful completion with nothing written to the logs, a particularly quiet failure mode for anyone running multi-tenant inference.<\/p>\n\n\n\n

“Our harness independently found the issue and reproduced it on a clean build,” Chainguard tells The New Stack<\/em>, noting that the bug is fixed in v0.31.0 and tracked under advisory GHSA-6cxc-2vcg-w5qc. The company added that “a number of other findings, including some in critical infrastructure software, are now being coordinated for disclosure,” and that Chainguard will share details once fixes are in place upstream.<\/p>\n\n\n\n

\n

“A number of other findings, including some in critical infrastructure software, are now being coordinated for disclosure,” <\/p>\n<\/blockquote>\n\n\n\n

Proof before patches<\/h2>\n\n\n\n

For a tool that leans on an AI model to hunt for flaws, the bigger question is whether those findings hold up, given how much noise AI-generated vulnerability reports can create for maintainers. “Harness proves a vulnerability is exploitable before it counts by reproducing potential exploits in fresh, isolated environments,” Chainguard tells The New Stack<\/em>, and anything that doesn’t reproduce consistently gets excluded from the report.<\/p>\n\n\n\n

Proposed fixes go through the same proof of concept, so the exploit has to succeed against the original code and fail against the patched version before the fix moves forward. A Chainguard engineer then approves every fix and report before it reaches a customer, keeping a human in the loop on what ultimately ships.<\/p>\n\n\n\n

\n

“Harness proves a vulnerability is exploitable before it counts by reproducing potential exploits in fresh, isolated environments.”<\/p>\n<\/blockquote>\n\n\n\n

The AI exploit gap<\/h2>\n\n\n\n

The launches come alongside The AI Exploit Gap<\/em><\/a>, a Chainguard-commissioned Wakefield Research survey of 1,300 security leaders across nine markets. More than half said their organizations knowingly leave high or critical vulnerabilities unpatched at least sometimes, with the figure reaching 66% at companies with $1 billion or more in revenue, compared with 27% at companies below $250 million.<\/p>\n\n\n\n

“AI can find and chain flaws in minutes, while fixing them still moves at human speed and competes with product deadlines and uptime,” Quincy Castro<\/a>, Chainguard’s chief information security officer, said in a statement. “Patching faster isn’t viable for most folks, and it will consume increasing amounts of resources just to keep pace.”<\/p>\n\n\n\n

Isolated microVMs for agents<\/h2>\n\n\n\n

Each developer and coding agent gets a hardware-isolated microVM with network policies that restrict access to internal systems.<\/p>\n\n\n\n

Credentials stay outside the agent’s environment, limiting what a compromised agent or malicious dependency can reach. Signed activity logs record what each agent did so teams can keep an audit trail across multiple autonomous sessions.<\/p>\n\n\n\n

CI inside the agent loop<\/h2>\n\n\n\n

Chainguard Checks lets coding agents run CI checks directly during development and receive signed results in seconds. Agents can run tests, inspect failures, and revise code before opening a pull request, avoiding the CI queues that become harder to manage as vendors like Cognition, Microsoft, and Augment Code turn coding agents into shared team infrastructure<\/a> running multiple sessions in parallel.<\/p>\n\n\n\n

To avoid rebuilding environments on every run, Checks uses warm snapshots with dependencies already installed and refreshes them in the background when the lockfile changes. Each workflow step runs in a separate hardware-isolated microVM built from Chainguard OS packages, including FIPS-compliant toolchains. With Workspaces, agent sessions pause during verification and resume with structured failure logs in context.<\/p>\n\n\n\n

Runners never hold long-lived credentials. Instead, a host-side proxy injects short-lived credentials into outbound requests, while declarative egress policies restrict network access and can terminate a microVM if it attempts an unauthorized connection. Successful runs produce signed attestations tied to the execution environment, test results, and commit, which merge gates can verify without rerunning the suite. Checks is available now in beta.<\/p>\n\n\n\n

Libraries Lock Down Late-Breaking Bugs<\/h2>\n\n\n\n

Chainguard Libraries is adding secure package endpoints for Go and .NET, along with CVE remediation for JavaScript and Go, while Java and Python support will expand to cover newly disclosed vulnerabilities discovered through AI-assisted research, including flaws in dependencies that coding agents may have already pulled into a project.<\/p>\n\n\n\n

Harness findings will feed directly into that pipeline. When Harness turns up a validated vulnerability in open source software, Chainguard sends it through coordinated disclosure, builds and reviews a patch, and distributes the fixed artifact through Chainguard Repository. <\/p>\n\n\n\n

The company’s Athena members get private, hardened patched builds before public disclosure, Chainguard tells The New Stack<\/em>, while other Libraries customers receive them once the embargo lifts, meaning companies “can stay protected against AI-discovered vulnerabilities immediately upon disclosure.”<\/p>\n\n\n\n

The changes build on Chainguard Repository<\/a>, a policy-enforced endpoint for open source dependencies, and its partnership with Cursor<\/a>, allowing coding agents to resolve packages through Chainguard’s catalog instead of pulling directly from public registries.<\/p>\n","protected":false},"excerpt":{"rendered":"

Chainguard has launched an AI-powered security harness that uses frontier models, including Anthropic’s restricted Claude Mythos 5.1, to find and<\/p>\n","protected":false},"author":3765,"featured_media":22840338,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[13989,9982,10056],"tags":[],"coauthors":[14698],"class_list":["post-22840329","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-agents","category-ci-cd","category-security"],"acf":[],"yoast_head":"\n66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out - The New Stack<\/title>\n<meta name=\"description\" content=\"Chainguard\u2019s new Harness points frontier models like Claude Mythos 5.1 at your code, alongside new tools to isolate coding agents and verify their work.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out\" \/>\n<meta property=\"og:description\" content=\"Chainguard\u2019s new Harness points frontier models like Claude Mythos 5.1 at your code, alongside new tools to isolate coding agents and verify their work.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/\" \/>\n<meta property=\"og:site_name\" content=\"The New Stack\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/thenewstack\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-14T05:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-14T11:48:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.thenewstack.io\/media\/2026\/10\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Amanda Caswell\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@AmandaCaswell\" \/>\n<meta name=\"twitter:site\" content=\"@thenewstack\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Amanda Caswell\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/\"},\"author\":{\"name\":\"Amanda Caswell\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#\\\/schema\\\/person\\\/55e1ff9ca21ec401993befa899c502d1\"},\"headline\":\"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out\",\"datePublished\":\"2026-10-14T05:00:00+00:00\",\"dateModified\":\"2026-10-14T11:48:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/\"},\"wordCount\":1128,\"publisher\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.thenewstack.io\\\/media\\\/2026\\\/10\\\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg\",\"articleSection\":[\"AI Agents\",\"CI\\\/CD\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/\",\"url\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/\",\"name\":\"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out - The New Stack\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cdn.thenewstack.io\\\/media\\\/2026\\\/10\\\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg\",\"datePublished\":\"2026-10-14T05:00:00+00:00\",\"dateModified\":\"2026-10-14T11:48:47+00:00\",\"description\":\"Chainguard\u2019s new Harness points frontier models like Claude Mythos 5.1 at your code, alongside new tools to isolate coding agents and verify their work.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cdn.thenewstack.io\\\/media\\\/2026\\\/10\\\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg\",\"contentUrl\":\"https:\\\/\\\/cdn.thenewstack.io\\\/media\\\/2026\\\/10\\\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg\",\"width\":2560,\"height\":1707,\"caption\":\"Ivan Vranic via Unsplash\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/chainguard-mythos-security-harness\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/thenewstack.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#website\",\"url\":\"https:\\\/\\\/thenewstack.io\\\/\",\"name\":\"The New Stack\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/thenewstack.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#organization\",\"name\":\"The New Stack\",\"url\":\"https:\\\/\\\/thenewstack.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/cdn.thenewstack.io\\\/media\\\/2021\\\/11\\\/a9fbec84-the-new-stack-logo-rgb-screen.png\",\"contentUrl\":\"https:\\\/\\\/cdn.thenewstack.io\\\/media\\\/2021\\\/11\\\/a9fbec84-the-new-stack-logo-rgb-screen.png\",\"width\":1032,\"height\":128,\"caption\":\"The New Stack\"},\"image\":{\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/thenewstack\",\"https:\\\/\\\/x.com\\\/thenewstack\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/#\\\/schema\\\/person\\\/55e1ff9ca21ec401993befa899c502d1\",\"name\":\"Amanda Caswell\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/thenewstack.io\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c176528b-cropped-54a705ce-amandacaswellheadshot_4-96x96.jpeg3467c8c979d67e16664fb0e58987890a\",\"url\":\"https:\\\/\\\/thenewstack.io\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c176528b-cropped-54a705ce-amandacaswellheadshot_4-96x96.jpeg\",\"contentUrl\":\"https:\\\/\\\/thenewstack.io\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c176528b-cropped-54a705ce-amandacaswellheadshot_4-96x96.jpeg\",\"caption\":\"Amanda Caswell\"},\"description\":\"Amanda Caswell is an AI journalist, certified prompt engineer, and technology commentator whose work and expertise have been featured on Fox News and CBS News. She covers artificial intelligence, developer tools, foundation models, and emerging technologies, with a particular focus on the companies and innovations shaping the future of AI, including OpenAI, Anthropic, Google, Meta, Microsoft, and Amazon. With more than two decades of professional writing and content experience, Caswell has held senior creative and editorial roles supporting major brands and technology organizations, including Amazon AWS, Walmart Health, and Bunim-Murray Productions. Her work spans technology, enterprise communications, content strategy, and journalism, giving her a unique perspective on how emerging technologies move from research labs into real-world adoption. She is known for translating complex technical developments into accessible reporting while maintaining a strong commitment to accuracy, source verification, and evidence-based journalism. Her reporting focuses on AI innovation, enterprise deployment, model releases, workplace transformation, developer ecosystems, and the broader impact of artificial intelligence on business and society. Caswell holds a B.S. in English with a concentration in Advertising from New York University and completed professional certification in prompt engineering and generative AI through MIT. Based in New Jersey, Caswell spends much of her time testing emerging AI tools, exploring how new technologies shape everyday life. She is also a lifelong runner and mother of three.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/amanda-caswell-745049a3\\\/\",\"https:\\\/\\\/x.com\\\/AmandaCaswell\"],\"url\":\"https:\\\/\\\/thenewstack.io\\\/author\\\/amanda-caswell\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out - The New Stack","description":"Chainguard\u2019s new Harness points frontier models like Claude Mythos 5.1 at your code, alongside new tools to isolate coding agents and verify their work.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/","og_locale":"en_US","og_type":"article","og_title":"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out","og_description":"Chainguard\u2019s new Harness points frontier models like Claude Mythos 5.1 at your code, alongside new tools to isolate coding agents and verify their work.","og_url":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/","og_site_name":"The New Stack","article_publisher":"https:\/\/www.facebook.com\/thenewstack","article_published_time":"2026-10-14T05:00:00+00:00","article_modified_time":"2026-10-14T11:48:47+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/cdn.thenewstack.io\/media\/2026\/10\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg","type":"image\/jpeg"}],"author":"Amanda Caswell","twitter_card":"summary_large_image","twitter_creator":"@AmandaCaswell","twitter_site":"@thenewstack","twitter_misc":{"Written by":"Amanda Caswell","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#article","isPartOf":{"@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/"},"author":{"name":"Amanda Caswell","@id":"https:\/\/thenewstack.io\/#\/schema\/person\/55e1ff9ca21ec401993befa899c502d1"},"headline":"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out","datePublished":"2026-10-14T05:00:00+00:00","dateModified":"2026-10-14T11:48:47+00:00","mainEntityOfPage":{"@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/"},"wordCount":1128,"publisher":{"@id":"https:\/\/thenewstack.io\/#organization"},"image":{"@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.thenewstack.io\/media\/2026\/10\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg","articleSection":["AI Agents","CI\/CD","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/","url":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/","name":"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out - The New Stack","isPartOf":{"@id":"https:\/\/thenewstack.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#primaryimage"},"image":{"@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.thenewstack.io\/media\/2026\/10\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg","datePublished":"2026-10-14T05:00:00+00:00","dateModified":"2026-10-14T11:48:47+00:00","description":"Chainguard\u2019s new Harness points frontier models like Claude Mythos 5.1 at your code, alongside new tools to isolate coding agents and verify their work.","breadcrumb":{"@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#primaryimage","url":"https:\/\/cdn.thenewstack.io\/media\/2026\/10\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg","contentUrl":"https:\/\/cdn.thenewstack.io\/media\/2026\/10\/bed61db0-ivan-vranic-j9-2liz2_rc-unsplash.jpg","width":2560,"height":1707,"caption":"Ivan Vranic via Unsplash"},{"@type":"BreadcrumbList","@id":"https:\/\/thenewstack.io\/chainguard-mythos-security-harness\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/thenewstack.io\/"},{"@type":"ListItem","position":2,"name":"66% of billion-dollar companies leave critical bugs unpatched \u2014 the part the AI bug-hunting hype leaves out"}]},{"@type":"WebSite","@id":"https:\/\/thenewstack.io\/#website","url":"https:\/\/thenewstack.io\/","name":"The New Stack","description":"","publisher":{"@id":"https:\/\/thenewstack.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/thenewstack.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/thenewstack.io\/#organization","name":"The New Stack","url":"https:\/\/thenewstack.io\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thenewstack.io\/#\/schema\/logo\/image\/","url":"https:\/\/cdn.thenewstack.io\/media\/2021\/11\/a9fbec84-the-new-stack-logo-rgb-screen.png","contentUrl":"https:\/\/cdn.thenewstack.io\/media\/2021\/11\/a9fbec84-the-new-stack-logo-rgb-screen.png","width":1032,"height":128,"caption":"The New Stack"},"image":{"@id":"https:\/\/thenewstack.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/thenewstack","https:\/\/x.com\/thenewstack"]},{"@type":"Person","@id":"https:\/\/thenewstack.io\/#\/schema\/person\/55e1ff9ca21ec401993befa899c502d1","name":"Amanda Caswell","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thenewstack.io\/wp-content\/uploads\/2026\/06\/c176528b-cropped-54a705ce-amandacaswellheadshot_4-96x96.jpeg3467c8c979d67e16664fb0e58987890a","url":"https:\/\/thenewstack.io\/wp-content\/uploads\/2026\/06\/c176528b-cropped-54a705ce-amandacaswellheadshot_4-96x96.jpeg","contentUrl":"https:\/\/thenewstack.io\/wp-content\/uploads\/2026\/06\/c176528b-cropped-54a705ce-amandacaswellheadshot_4-96x96.jpeg","caption":"Amanda Caswell"},"description":"Amanda Caswell is an AI journalist, certified prompt engineer, and technology commentator whose work and expertise have been featured on Fox News and CBS News. She covers artificial intelligence, developer tools, foundation models, and emerging technologies, with a particular focus on the companies and innovations shaping the future of AI, including OpenAI, Anthropic, Google, Meta, Microsoft, and Amazon. With more than two decades of professional writing and content experience, Caswell has held senior creative and editorial roles supporting major brands and technology organizations, including Amazon AWS, Walmart Health, and Bunim-Murray Productions. Her work spans technology, enterprise communications, content strategy, and journalism, giving her a unique perspective on how emerging technologies move from research labs into real-world adoption. She is known for translating complex technical developments into accessible reporting while maintaining a strong commitment to accuracy, source verification, and evidence-based journalism. Her reporting focuses on AI innovation, enterprise deployment, model releases, workplace transformation, developer ecosystems, and the broader impact of artificial intelligence on business and society. Caswell holds a B.S. in English with a concentration in Advertising from New York University and completed professional certification in prompt engineering and generative AI through MIT. Based in New Jersey, Caswell spends much of her time testing emerging AI tools, exploring how new technologies shape everyday life. She is also a lifelong runner and mother of three.","sameAs":["https:\/\/www.linkedin.com\/in\/amanda-caswell-745049a3\/","https:\/\/x.com\/AmandaCaswell"],"url":"https:\/\/thenewstack.io\/author\/amanda-caswell\/"}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/posts\/22840329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/users\/3765"}],"replies":[{"embeddable":true,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/comments?post=22840329"}],"version-history":[{"count":5,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/posts\/22840329\/revisions"}],"predecessor-version":[{"id":22840372,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/posts\/22840329\/revisions\/22840372"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/media\/22840338"}],"wp:attachment":[{"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/media?parent=22840329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/categories?post=22840329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/tags?post=22840329"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/thenewstack.io\/wp-json\/wp\/v2\/coauthors?post=22840329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}