Last week, Anthropic released https://github.com/anthropics/defending-code-reference-harne..., a reference harness for autonomous vulnerability discovery that uses Claude Code agents to find, verify, and patch memory-safety bugs. I wanted to use it but I only have access to GitHub Copilot.

This is a port of that harness to the GitHub Copilot CLI. PORTING-PLAN.md covers the decisions made to map the handful of features that work differently between Claude Code and the Copilot CLI.

The result is a working reference for anyone who wants to build autonomous security agents on Copilot, tracking Anthropic's approach as closely as possible.

Feedback welcome!