The Australian Signals Directorate (ASD) has published a further update on the growing role of AI model harnesses in cyber security, warning that organisations must understand and adopt these tools as a matter of urgency. Building on advisories issued in April and May 2026, ASD’s latest guidance highlights that AI model harnesses, the orchestration layers built around one or more AI models that coordinate tasking, output verification, and multi-agent workflows, are proving to be as critical a determinant of cyber capability as the underlying AI models themselves. Importantly, the agency notes that organisations do not need access to the most advanced frontier AI models to mount an effective cyber defence; a well-engineered harness orchestrating mid-tier models can achieve results comparable to those of top-tier systems, lowering the barrier to entry for defenders of all sizes.
A number of significant AI harness releases have been flagged in the advisory as shaping the current landscape. Microsoft’s MDASH coordinates more than 100 specialised AI agents across multiple frontier models to discover and prove exploitable vulnerabilities end-to-end, with its findings contributing to Microsoft’s June 2026 Patch Tuesday release — the largest on record at 206 patches. Anthropic has released an open-source Defending Code Reference Harness providing structured vulnerability discovery and remediation pipelines, alongside its Project Glasswing initiative offering selected organisations access to Claude Mythos for defensive purposes. Cisco, OpenAI, and open-source project OpenHack have similarly released model-agnostic and accessible harness frameworks designed to bring AI-assisted vulnerability research into mainstream security workflows, with OpenAI also establishing a Trusted Access for Cyber partnership with Australia.
However, ASD has been clear that these capabilities are inherently dual-use where the same tools that can find and fix vulnerabilities can equally be weaponised to discover and exploit them. The agency warns that the lowering of cost and skill barriers benefits malicious actors just as much as defenders, meaning the protective advantage only holds if organisations adopt these tools at least as quickly as their adversaries. ASD has indicated it will release practical guides on integrating AI harnesses into cyber defence workflows, urging Australian organisations to begin building familiarity with these technologies without delay.