Notifications
Clear all
Topic starter
02/08/2026 11:31 am
TL;DR: AI vulnerability discovery is increasingly determined by harness design, orchestration, and validation rather than by the frontier model alone, according to Aikido’s analysis of Mythos, GPT-5.5, and multi-agent scan patterns. The practical shift is toward cheaper, multi-tier systems that scale candidate generation while preserving verification quality and reducing cost.
NHIMG editorial — based on content published by Aikido: Move over, Mythos. Here comes... pretty much any other model with a good harness
Questions worth separating out
Q: How should security teams secure AI-assisted development without overwhelming AppSec workflows?
A: Start with continuous discovery, then connect findings to exposure, criticality, and data sensitivity before remediation begins.
Q: Why do multi-agent harnesses often outperform a single frontier model?
A: Multi-agent harnesses outperform single-model approaches because they distribute tasks, repeat exploration, and add independent validation.
Q: What breaks when AI security tools rely on model benchmarks alone?
A: Benchmark-only decisions break when teams assume capability scores translate directly into operational security.
Practitioner guidance
- Define harness trust boundaries Map which agents, prompts, tools, and repositories each stage can access, then document where validation authority begins and ends.
- Separate discovery from validation Run candidate generation and independent verification as distinct stages, with different prompts and no shared assumptions.
- Use cheaper models for breadth Reserve expensive models for deep analysis and use lower-cost models to expand coverage across large codebases, many repositories, or repeated scans.
What's in the full article
Aikido's full blog post covers the operational detail this post intentionally leaves for the source:
- How Aikido structures its recon, hunt, validation, and tracing stages inside the harness
- The practical cost comparison between large frontier models and cheaper multi-agent runs
- Why the vendor argues model choice is secondary to orchestration design in AppSec
- The Mythos-ready checklist for teams preparing for agentic AI threats
👉 Read Aikido's analysis of why harness design outperforms model choice in AppSec →
AI pentesting harnesses: what they change for AppSec teams?
Explore further
02/08/2026 12:46 pm
Harness governance is becoming the real security control in AI-assisted AppSec. The model is increasingly a replaceable component, while routing, validation, and escalation decide whether outputs are defensible. That means the security question is no longer which model a team bought, but whether the surrounding workflow can absorb model variability safely. For practitioners, the governance layer is now where quality, accountability, and risk are actually managed.
A question worth separating out:
Q: Should organisations use expensive models for every AppSec scan?
A: No. Expensive models are best reserved for deep reasoning, complex validation, or ambiguous findings. For broad scanning, repeated passes with cheaper models often produce better coverage at a sustainable cost, especially when paired with strong validation and deduplication. Most organisations get better security economics by scaling the harness, not the model bill.
👉 Read our full editorial: Harness design matters more than frontier model choice in AppSec
