Google’s AI security agents found 100+ critical software vulnerabilities in just two days
Google Mandiant's AVDH, a chain of AI agents, found over 100 verified high-severity vulnerabilities and 12 assigned CVEs scanning code for ten months.
Google Mandiant disclosed AVDH (Agentic Vulnerability Discovery Harness), an internal pipeline of chained AI agents built on the Agent Development Kit that hunts vulnerabilities in source code. In a live investigation of stolen corporate repositories it verified more than 100 high-severity flaws in two days; over ten months it scanned tens of millions of lines of code and produced tens of thousands of findings, yielding 12 assigned CVEs including CVE-2026-13242 and CVE-2026-55803, with about a dozen more in active disclosure. Human consultants manually reproduce every confirmed finding before it counts.
- AVDH chains specialized AI agents for threat modeling, entry point discovery, context enrichment, hypothesis generation, and validation.
- Running inside Mandiant for ten months, it scanned tens of millions of lines and produced tens of thousands of findings.
- Output includes 12 assigned CVEs, such as CVE-2026-13242 and CVE-2026-55803, with another dozen in active disclosure.
- Consultants manually reproduce every confirmed finding; agents challenge each other's hypotheses using consultant-written rules by domain.
- Vendors
- Products
- AVDHAgent Development Kit
- Organizations
- GoogleMandiantGoogle Threat Intelligence Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13242 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection | 6.5 | <1% | ||
| CVE-2026-55803 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection | 5.9 | <1% |
From the original article
3 min read at helpnetsecurity.com
Google’s Mandiant has disclosed the workings of an internal tool that uses chains of AI agents to hunt for vulnerabilities in source code, saying it found over 100 verified, high-severity flaws in just two days during a live investigation into stolen corporate repositories. The tool, called the Agentic Vulnerability Discovery Harness (AVDH), has been running inside Mandiant for ten months.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.