Google’s AI security agents found 100+ critical software vulnerabilities in just two days

Google’s Mandiant has disclosed the workings of an internal tool that uses chains of AI agents to hunt for vulnerabilities in source code, saying it found over 100 verified, high-severity flaws in just two days during a live investigation into stolen corporate repositories.

The tool, called the Agentic Vulnerability Discovery Harness (AVDH), has been running inside Mandiant for ten months. In that time it has scanned tens of millions of lines of code and produced tens of thousands of findings, according to a blog post published by the Google Threat Intelligence Group.

The tool has uncovered dozens of assignable flaws in widely used web extensions and open-source projects, Mandiant researchers Alex Tselevich and Michael Maturi wrote, resulting in 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803, with “an additional dozen currently in active disclosure.”

How the pipeline works

AVDH runs as a sequence of specialised agents, each handing its output to the next, built on Google’s Agent Development Kit. The stages are:

Threat modeling: An agent maps the codebase, figures out what kind of software it is, and marks which parts to skip, such as test directories. A human reviews the resulting threat model before anything else happens.

Entry point discovery: Agents scan every file in scope to find places where user input enters the application, from web routes to inter-process listeners.

Context enrichment: For each entry point, an agent pulls together scattered, relevant code, such as permission checks and input sanitizers, that a reviewer would otherwise have to chase down by hand.

Hypothesis generation: Separate agents look for access-control problems, including missing authorization, privilege escalation, and cross-site request forgery, and for dangerous data flows, the kind that lead to SQL injection, cross-site scripting, command injection, and path traversal.

Hypothesis validation: Several agents, deliberately run at high “temperature” settings to widen the range of reasoning they produce, weigh in on each hypothesis. A synthesis agent then sorts each one into confirmed, disproven, or rejected.

Every confirmed finding still goes to a person before it counts for anything. Mandiant consultants reproduce the exploit and run proof-of-concept code to check that the flaw is genuine and that no overlooked control blocks it. Findings that fail that test get thrown out.

Human-in-the-loop handover diagram (Source: Google)

“We encourage network defenders considering implementing similar vulnerability discovery harnesses to manually validate findings,” Mandiant researchers Alex Tselevich and Michael Maturi noted.

Cutting down on false alarms

Automated code scanners have long had a reputation for noise, findings that look plausible on paper but don’t hold up once someone checks them. Mandiant says it built AVDH specifically to fight that problem, by having agents challenge each other’s conclusions and check them against rules written by its own consultants, rather than simply flagging code patterns that resemble known bugs.

Those rules are organised by software domain, then split into three groups, language, framework, and vulnerability type, so the knowledge stays reusable as the tool is pointed at different codebases.

To grade its own performance, Mandiant built a set of synthetic, deliberately vulnerable codebases rather than relying on public vulnerability datasets, out of concern that today’s models may already have seen those datasets during training and could be recalling answers rather than reasoning through them.

“Securing the software development pipeline has emerged as a defining challenge in modern enterprise defense.”

“To match these emerging threats, securing the code pipeline must be a critical component of a modern defense strategy. Manual source code review can’t keep pace with AI, and traditional scanning engines consistently miss the broad spectrum of vulnerabilities hidden in modern software,” researchers added.

“However, the success of our harness proves defenders can reclaim the advantage against adversarial AI. By embedding frontier models within an expert-defined harness, defenders can automate the discovery of routine vulnerabilities,” they concluded.