Google's Mandiant Uses AI Agents to Find Code Flaws Before Attackers Do

Google Threat Intelligence says misuse of AI by attackers has raised the risk of data theft and extortion. When a company's proprietary source code is exposed, defenders must rush to find and fix weaknesses while attackers use AI tools that work at machine speed.

To respond, Google's Mandiant team uses an internal framework called the Agentic Vulnerability Discovery Harness (AVDH). It combines several AI agents with structured processes, skeptical validation steps and input from human subject-matter experts. It is used in proactive code reviews, penetration tests, red team operations and incident response, and it helps with the discovery and validation of routine vulnerabilities so that people can focus on harder problems. Google says it can also be used alongside CodeMender's ongoing scanning for a two-layered defence, and it is sharing the architecture for the first time to help other defenders.

The reported results are significant. In a recent incident response involving stolen corporate repositories, the harness found over 100 true-positive critical vulnerabilities in two days, a fraction of the time manual review would need. Across 10 months, it has analysed environments with tens of millions of lines of code and produced tens of thousands of findings. This led to 12 assigned CVEs in widely used web extensions and open-source projects, with a further dozen in active disclosure. This summary covers only the opening of the article.