Based on Anthropic’s Defending Code reference harness. This fork is not maintained by or affiliated with Anthropic.
Run Anthropic's Defending Code reference harness with Bedrock inference inside Firecracker-isolated Lambda MicroVMs. Enterprise-grade security scanning with zero data exfiltration risk.
Running entirely on AWS may help meet data residency requirements for compliance frameworks such as SOC 2, FedRAMP, HIPAA, and PCI-DSS.
Many enterprises cannot send source code to external APIs due to compliance requirements. This solution keeps everything inside your AWS account boundary.
Source code never leaves your VPC. Claude runs via Bedrock's inference endpoints within your region. No data sent to external APIs.
Use existing IAM roles, SCPs, and permission boundaries. No long-lived API keys to rotate. Instance roles auto-manage credentials.
Every model invocation logged with caller identity, timestamp, and request metadata. Complete audit trail for compliance teams.
Pair with VPC endpoints for Bedrock to eliminate internet egress entirely. Zero-egress architecture for maximum data isolation.
Each scan runs in a fresh Firecracker microVM destroyed after use. No state persists. No forensic artifacts. No cleanup required.
No Docker daemons, no gVisor runtime, no proxy configuration. Deploy with CloudFormation, scan in seconds.
Run vulnerability scans on every PR before merge. Claude autonomously reads code, identifies memory safety issues, and crafts proof-of-concept exploits to validate findings.
Scan acquired codebases for vulnerabilities without exposing source to external services. Results stay within your account for internal review only.
Healthcare, finance, and government teams can leverage AI-powered vulnerability discovery while meeting data residency and auditability requirements.
Trigger scans from CodePipeline, GitHub Actions, or Jenkins. Lambda MicroVMs auto-scale to handle parallel scans across your codebase.
Augment your security team's manual review with autonomous multi-turn analysis. Claude explores attack surfaces, chains vulnerabilities, and reports exploitable paths.
Audit vendor libraries and open-source dependencies in isolation. Each scan runs in its own microVM with no access to your production environment.
The orchestrator spawns ephemeral Lambda MicroVMs with zero outbound network, calls Bedrock for model inference, and routes tool execution (bash, file I/O) into each isolated sandbox via authenticated HTTPS.
Claude Sonnet 4.6 running via Bedrock inside a Lambda MicroVM, autonomously discovering and validating a heap-buffer-overflow.
/work/entry.c — identifies 3 parsers dispatched by first byteCrash type: heap-buffer-overflow (WRITE)
Location: entry.c:27 — memcpy(out, buf + 1, claimed);
Root cause: malloc(8) allocates 8 bytes, but 'claimed' is taken
directly from input byte[0] (0–255) with no bounds check.
PoC sets claimed=0xFF → 255 bytes into 8-byte buffer.
ASAN: ==190==ERROR: AddressSanitizer: heap-buffer-overflow
at 0x502000000018 — WRITE of size 255
Reproduced: 3/3 (exit code 1, SIGABRT)
| Dimension | Docker + gVisor | Lambda MicroVM |
|---|---|---|
| Isolation | User-space kernel (gVisor) | Hardware microVM (Firecracker) stronger |
| Setup | Install runsc, configure Docker daemon, build proxy | aws cloudformation deploy simpler |
| Boot time | Container start (~seconds) | Snapshot resume (<3s) faster |
| Scaling | Manual (--parallel on one host) | Lambda auto-scales automatic |
| Cost | EC2 instance-hours (always on) | Per-invocation only pay-per-use |
| State leakage | Possible if container reused | Impossible (ephemeral) zero risk |
| Kernel escape | gVisor user-space boundary | Firecracker hypervisor hardware |
| Platform | Linux only (gVisor requirement) | Any OS (orchestrator only) portable |
# 1. Deploy infrastructure (one-time) aws cloudformation deploy --template-file infra/template.yaml \ --stack-name vuln-pipeline-microvm --capabilities CAPABILITY_IAM # 2. Build and register MicroVM image (~2.5 min) ./scripts/build_microvm_artifact.sh canary aws s3 cp microvm-artifacts/canary.zip s3://<bucket>/canary.zip aws lambda-microvms create-microvm-image --name vuln-pipeline-canary \ --base-image-arn arn:aws:lambda:<region>:aws:microvm-image:al2023-1 \ --build-role-arn arn:aws:iam::<acct>:role/MicroVMBuildRole \ --code-artifact '{"uri":"s3://<bucket>/canary.zip"}' # 3. Run the vulnerability scan CLAUDE_CODE_USE_BEDROCK=1 AWS_REGION=us-west-2 \ python3 -m harness.cli run canary \ --model us.anthropic.claude-sonnet-4-6 \ --sandbox microvm \ --microvm-image arn:aws:lambda:<region>:<acct>:microvm-image:vuln-pipeline-canary \ --microvm-execution-role arn:aws:iam::<acct>:role/MicroVMExecutionRole
From Anthropic's learnings partnering with security teams: models will use whatever capabilities they actually have access to, not just what you tell them. Constraints must be enforced in code, not in prompts.
"One team told their model it had no network access — the model found GitHub anyway. Another team's agent answered a GitHub issue mid-scan. Neither was malicious. Both demonstrated that prompt-level instructions are insufficient when agents have real capabilities."
— Anthropic, Using LLMs to Secure Source Code
The infrastructure enforces five properties that no prompt can guarantee:
| Property | Enforcement mechanism |
|---|---|
| Hypervisor isolation | Each agent runs in its own Firecracker VM with a dedicated kernel. Container escape ≠ host escape. |
| Network isolation | MicroVM sits in a private subnet with no internet route. Only the Bedrock VPC endpoint is reachable. |
| IAM scoping | Execution role grants only bedrock:InvokeModel*. No S3, no EC2, no other AWS access from inside. |
| Ephemeral | MicroVM destroyed after each agent completes. No state persists — no forensic artifacts remain. |
| Time-bounded | Auth tokens expire in 60 minutes max. MicroVM auto-terminates on idle timeout. |
The pipeline separates finding and grading into different MicroVMs to defeat reward-hacking:
Reads source, crafts inputs, runs binary, triggers crashes
Receives only PoC bytes + source. Reproduces crash independently.
The grade agent never sees the find agent's reasoning, intermediate files, or container state.
The key difference from static analysis: this pipeline produces execution-verified crashes — a concrete input that triggers a memory error 3/3 times.
| Stage | What happens | Isolation |
|---|---|---|
| Recon | Agent partitions the attack surface into focus areas | MicroVM |
| Find | Parallel agents craft inputs and trigger ASAN crashes | MicroVM per agent |
| Grade | Separate MicroVM reproduces each crash with only the PoC bytes | Separate MicroVM |
| Judge | No-tools agent compares crashes semantically — NEW, DUP_BETTER, or DUP_SKIP | No code execution |
| Report | Agent writes exploitability analysis with severity rating | MicroVM |
| Patch | Agent generates fix; grader confirms PoC no longer crashes | MicroVM |
| Verify | Builds, runs PoC, runs test suite, re-attacks patched binary (T0–T3) | MicroVM |
Best practices from real engagements with security teams. The learnings that informed this pipeline's design.
Anthropic's managed hosted product. Multi-stage verification, lifecycle management, rapid fix generation.
Purchase Claude for Enterprise through your existing AWS billing. No additional procurement process.
Lightweight walkthrough of the recon → find → triage → report → patch loop using the Agent SDK.
Three sandbox options depending on your security requirements, AWS account access, and operational preferences.
Claude Code runs inside the MicroVM and calls Bedrock directly via CLAUDE_CODE_USE_BEDROCK=1. Simplest setup — no orchestrator proxy, no work server.
Firecracker isolation • Auto-scaling • Pay-per-use
Documentation →Maximum isolation — MicroVM has zero outbound network. Orchestrator proxies all Bedrock calls. Source code physically cannot leave the Firecracker boundary.
Zero egress • Adversarial code • Compliance-ready
Documentation →Standard EC2 instances via SSM RunCommand. No Lambda MicroVM preview access needed. Unlimited scan duration, install custom tools at boot.
Any AWS account • Unlimited duration • Custom tooling
Documentation →
Based on Anthropic’s Defending Code reference harness. This fork is not maintained by or affiliated with Anthropic.