66% of billion-dollar companies leave critical bugs unpatched — the part the AI bug-hunting hype leaves out
The New Stack Amanda Caswell
Chainguard launched an AI security tool that finds bugs scanners miss. Its survey says 66% of billion-dollar firms still leave critical flaws unpatched at times.
Based on reporting by The New Stack, Amanda Caswell — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Chainguard is betting that the next security gap is inside the development loop itself. On Wednesday, the company announced Harness, an AI-powered security system that uses frontier models, including Anthropic’s restricted Claude Mythos 5.1, to spot and fix exploitable bugs in application code that conventional scanners miss.
The pitch is simple enough: let AI hunt for flaws faster than human teams can, then wire that into the places where code actually gets built and checked. But Chainguard isn’t saying exactly how that works for everyone. Developers can use Harness without direct access to Mythos, yet the company has not said which models handle vulnerability discovery for customers outside Anthropic’s Project Glasswing program.
That silence matters because Chainguard is claiming it has already found serious vulnerabilities in codebases that had gone through extensive security scanning, including software used in critical infrastructure. The company isn’t naming the projects, the bugs, or whether the problems have been fixed. So the headline is powerful, but the evidence is still behind the curtain.
Harness is only one part of a broader release. Chainguard also announced Workspaces, Checks, and expanded Libraries protections, pushing beyond hardened container images and dependencies into agent execution environments and CI verification. Checks puts CI inside the agent workflow so coding agents can run tests and get signed results in seconds, while Workspaces pauses sessions during verification and resumes with failure logs in context.
There is a business wrinkle too. Harness will also show up in Anthropic’s Claude Marketplace, which means teams may be able to spend existing Anthropic commitments instead of finding a new budget line. Meanwhile, Chainguard’s commissioned Wakefield Research survey of 1,300 security leaders across nine markets found that more than half said their organizations knowingly leave high or critical vulnerabilities unpatched at least sometimes. Among companies with $1 billion or more in revenue, that figure rose to 66%, versus 27% for companies below $250 million.
That is the part the AI bug-hunting hype often skips. Finding flaws is getting faster. Fixing them still has to survive deadlines, uptime demands, and the ordinary chaos of shipping software.
My take — AI-written commentary, not fact-checked reporting
This is the real AI security story: discovery is getting automated, remediation is still stuck in committee. A tool that can find bugs faster is useful; a company that can make people patch them is the one worth watching. The rest is just another demo with a nicer slide deck.
Read more about this at: The New Stack