Harden - A security layer for AI coding agents
by•
Harden AIF is a free, local security tool for AI coding agents. Its post-trained model checks tool calls before they run, using your request and session context. It beat frontier models on key agent-security benchmarks, while keeping your repo and tool output on your machine.
Replies
@hamza_afzal_butt Great question, but it totally depends on the device that you are on, for example on an M5 Pro, The p50 latency is about 2 seconds and p95 latency is about 3.4 seconds. However, this is one thing which we are working on actively right now to push the latency below 500ms.
Really cool approach to agent security. Love that the checks happen locally while still being powerful enough to catch risky tool calls.
@harsh_rathore10 Thanks, Harsh. Really glad you like the approach and that it resonated with you. Also, really good DP :)
Security usually gets added after something goes wrong. Building it directly around agent actions feels like a much better approach.
@subhash_kanagamani Very much indeed Subhash! I hope you try our product out!
@subhash_kanagamani Totally agreed with you, Subhash, and that is exactly why we built Harden.
This is such an interesting problem to solve. We’re giving agents more autonomy every month, so the security layer has to catch up too
@prakhar_gupta44 Yeah, exactly. As agents get more dominance, the security has to speed up, but now Harden has got your back, and it is free for individual developers. You can just set it up in a single command. If you hit any issue while setting up, just book a call with us. Our team would be more than happy to help you out
"Babysitting caps how much work you can hand off" is such a clean way to put it. I also like that it all stays local, a tool that reads every command is exactly the thing you don't want phoning home. Does the model learn anything from what you approve or reject over time?
@protsenkoalexandra As of now the model doesn't learn locally but this is a feature that we are working on - based on your long term approve / reject pattern, AIF will be able to actively adapt itself to ensure it runs in the way you expect it to.
@rishav99 cool :)
@iamhetpatel Thanks, Het. Great question. That number matters a lot for something that sits on every tool call. We specifically train and evaluate Harden model to keep false positives low. For example, our SLEIGHT evaluation reports TPR at a ≤1% false-positive rate, and LinuxArena is also measured at a 1% step-wise FPR target.
I would love to hear how it behaves in your daily sessions and how many tool calls it ends up blocking for you. You can also refer to this article for more details on the benchmarks and evaluation setup: https://harden.run/blog/aif-research-and-evidence
And of course, happy to answer any other questions you might have.
I like that the agent keeps working after one action gets blocked. A security layer that doesn't constantly interrupt the workflow sounds much better. looking forward to it
@abod_rehman Exactly, that’s the idea. We wanted the security layer to step in when needed without becoming another blocker for the agent. Really appreciate you checking it out 🙌
Congrats on the launch! Love that it checks agent actions locally before they actually run.. feels like a no brainer for anyone letting coding agents loose on real repos. Upvoted, excited to see where this goes!!
@vinayak_mishra5 Appreciate that a lot! That’s exactly the use case we had in mind, keeping agents useful without giving them unchecked access to real environments. Thanks for the upvote and support 🙌
the intent-boundary check is the part i'd stress test hardest — real tasks drift too, agent finds it needs to touch a file you never mentioned but that's still correct. curious what your false-positive rate looks like on normal work vs the obvious stuff (rm -rf, exfil). that gap is usually where security layers get disabled by day 3, not where they fail the demo.
@pushpendraw You are absolutely right on this one! However, this is where we have spent the most time designing our product, our post trained model is trained in a way to clearly draw the contrast between dangerous/misaligned and "dangerous looking" but legitimate actions. Therefore, our model is trained to understand drift and block or steer the agent back into the right direction. That being said, this pipeline will keep getting even better quickly!
The “nervous parent” analogy is painfully accurate. Giving coding agents more autonomy without giving up control feels like the missing piece.
@ramana_abhishek Hi Ramana, glad that analogy felt relatable, and that is exactly the feeling we are trying to solve for with Harden.