How anthropics/defending-code-reference-harness works
This repository is a reference implementation for autonomous vulnerability discovery and remediation, with a separate detection-and-response pipeline for hunting attacker activity in logs. The principal vulnerability workflow scopes a target, searches for a crash, verifies and triages it, produces an exploitability report, then generates and checks a patch. A second workflow runs a hunt agent and grades its incident submission. The graph retains the major documented stages; some internal calls are not visible in the excerpts, so those links are omitted or marked unverified.
Main entry points: harness/cli.py Pipeline CLI · dnr_harness/cli.py DNR pipeline CLI · patch_grade.py Patch grading · agent.py Agent runner
Components 30
Vulnerability pipeline
- Pipeline CLI
harness/cli.py - Target config
harness/config.py - Recon stage
harness/recon.py - Crash discovery
harness/find.py - Crash verification
harness/grade.py - Finding triage
harness/judge.py - Exploitability report
harness/report.py - Finding deduplication
harness/dedup.py - Novelty check
harness/novelty.py - Pipeline artifacts
harness/artifacts.py
Agent runtime
- Agent prompts
harness/prompts - Untrusted-data wrapper
harness/prompts/untrusted.py - Agent runner
harness/agent.py - Provider auth
harness/auth.py - Agent sandbox
harness/sandbox.py - Agent image
harness/agent_image.py - Container operations
harness/docker_ops.py
Patch verification
- Patch generation
harness/patch.py - Patch grading
harness/patch_grade.py - ASAN analysis
harness/asan.py
Detection response
- DNR pipeline CLI
dnr_harness/cli.py - DNR configuration
dnr_harness/config.py - DNR prompts
dnr_harness/prompts.py - DNR agent image
dnr_harness/agent_image.py - DNR system prompt
dnr_harness/system_prompt.py
Targets
- DNR demo target
targets/dnrcanary/app/app.py - Demo log corpus
targets/dnrcanary/generate_logs.py - Incident grader
targets/dnrcanary/grade.py
Other components
- Pipeline operator
- Claude API
Connections 34
- Pipeline operator → Pipeline CLI: runs
- Pipeline CLI → Target config: loads target
harness/cli.py - Pipeline CLI → Recon stage: starts stage
harness/cli.py - Pipeline CLI → Crash discovery: starts stage
harness/cli.py - Pipeline CLI → Crash verification: starts stage
harness/cli.py - Pipeline CLI → Finding triage: triages findings
harness/cli.py - Pipeline CLI → Exploitability report: starts stage
harness/cli.py - Pipeline CLI → Patch generation: starts stage
harness/cli.py - Crash discovery → Crash verification: submits crash
- Crash verification → Finding triage: provides finding
- Finding triage → Exploitability report: selects finding
- Exploitability report → Patch generation: feeds patching
- Pipeline CLI → Finding deduplication: uses
harness/cli.py - Pipeline CLI → Novelty check: uses
harness/cli.py - Pipeline CLI → Pipeline artifacts: records results
harness/cli.py - Crash discovery → Agent prompts: uses prompt
harness/find.py - Agent prompts → Untrusted-data wrapper: wraps input
harness/prompts/find_prompt.py - Agent runner → Agent sandbox: runs within
harness/agent.py - Agent sandbox → Agent image: ensures image
harness/sandbox.py - Agent sandbox → Container operations: starts container
harness/sandbox.py - Agent runner → Claude API: invokes CLI
harness/agent.py - Provider auth → Agent runner: provides environment
- Patch generation → Patch grading: grades diff
harness/patch.py - Patch grading → ASAN analysis: uses analysis
harness/patch_grade.py - Patch grading → Container operations: executes checks
harness/patch_grade.py - Patch grading → Agent runner: runs style judge
harness/patch_grade.py - Pipeline operator → DNR pipeline CLI: runs
- DNR pipeline CLI → DNR configuration: loads settings
dnr_harness/cli.py - DNR pipeline CLI → DNR prompts: uses prompts
dnr_harness/cli.py - DNR pipeline CLI → DNR system prompt: sets system prompt
dnr_harness/cli.py - DNR pipeline CLI → DNR agent image: uses image
dnr_harness/cli.py - DNR pipeline CLI → DNR demo target: hunts target
- DNR pipeline CLI → Demo log corpus: hunts logs
- DNR pipeline CLI → Incident grader: submits incidents
dnr_harness/cli.py