Google’s Threat Intelligence Group on August 19, 2026 publicly detailed for the first time an internal AI agent pipeline, the Agentic Vulnerability Discovery Harness (AVDH), which found over 100 true-positive critical vulnerabilities in stolen corporate source code within two days during an incident-response case.
The Big Picture
- Google’s AVDH tool found more than 100 true-positive critical vulnerabilities in stolen corporate repositories in just two days during a real incident-response investigation.
- The harness, per Mandiant, has run internally for 10 months, analyzing codebases spanning tens of millions of lines of code across thousands of pipeline runs.
- The harness has led to 12 assigned CVEs so far, including CVE-2026-13242 and CVE-2026-55803, with roughly a dozen more in active coordinated disclosure.
- During a client red-team test, per Google, AVDH also surfaced a remote-code-execution flaw that gave attackers a path to initial access.
- The tool has limits: AVDH is not meant to replace human security researchers, per Google Threat Intelligence Group, and every confirmed finding still goes through expert proof-of-concept validation.
According to Cybersecurity Attacks Statistics, over 75,000 cyberattacks occur every hour worldwide, the automated pressure defenders like Mandiant are trying to out-pace. Manual source-code review was never built for that volume.
Seven Agents Split the Code Review
Seven specialized agents make up Google’s AVDH pipeline. An Explorer agent profiles the target codebase before Threat Model Synthesis, Discovery, Enrichment, Access Control, Data Flow Analysis, and Validation agents each take a defined stage of the analysis, per Mandiant’s technical write-up. The system is built on the Google Agent Development Kit (ADK), the same orchestration framework behind Google Antigravity.
That structure matters because raw model output is unreliable at this scale. Chaining narrow, single-purpose agents behind a fixed threat model is what turns a probabilistic language model into something closer to a repeatable audit tool.
Two agent types do the heaviest lifting. An Access Control agent checks whether privileged functionality is exposed to unauthorized users, while a Data Flow Analysis agent traces user input to dangerous “sinks” that can trigger SQL injection, cross-site scripting, command injection, or path traversal. Validation agents then run at a higher model temperature to stress-test each hypothesis before a Synthesis agent marks it confirmed, disproven, or rejected.
Confirmed findings still stop at a human gate. Once validated, the consultant synthesizes the AI generated finding with their own expert analysis and prepares it for formal disclosure. Consultants replicate the exploit and run proof-of-concept code before any finding proceeds to disclosure, and findings that fail that test are discarded.
Discarding what cannot be reproduced costs time. It also keeps the false-positive rate low enough that a client reads the next report.
The Speed Gap AVDH Is Built to Close
Some of that pressure now originates inside the codebase itself: AI Coding Security Vulnerability Statistics tracking shows 45% of AI-generated code contains security vulnerabilities, per Veracode’s 2025 analysis. Separate Cybersecurity Statistics tracking shows the mean time to detect a data breach runs to 181 days.
Those two figures describe one asymmetry from opposite ends: insecure code reaches production faster than reviewers can read it, while defenders need months to notice when it gets exploited. A two-day pass over a stolen repository does not close that gap, though it helps move review onto something closer to the attacker’s clock.
A one-off review still leaves the question of what watches the code once the engagement ends.
Two-Layer Defense Strategy
Google positions AVDH as complementary to CodeMender, its separate continuous-scanning tool, and to the Google AI Threat Defense platform, which bundles CodeMender’s scanning and remediation into an always-on service. The pairing reads as a deliberate two-tier model: AVDH for deep, point-in-time reviews during incidents or red-team engagements, CodeMender for the ongoing monitoring that catches what a one-time scan misses.
Benchmark integrity is a real constraint on how much to trust the numbers. Google built proprietary synthetic codebases for evaluation rather than relying on public vulnerability datasets, because frontier models may have already ingested those public repositories during training. Security consultants manually verify every injected vulnerability in those benchmarks before AVDH is graded against them. The score therefore rests on a benchmark nobody outside Mandiant can inspect.
What’s Next?
Roughly a dozen vulnerabilities AVDH has already flagged sit in active coordinated disclosure, so affected vendors and the teams running their software should expect patch advisories over the coming weeks as those processes close out.
Security teams weighing a similar setup have two markers in Google’s guidance: pair any agentic scanner with a human validation gate, and build proprietary benchmark code rather than trusting public datasets a model may already have memorized.
SQ Magazine’s Takeaway
The two-day result Google disclosed reads as a signal about where the defensive gap actually sits. Attackers already move at machine speed once they hold stolen source code, and manual review cannot match that pace. Google’s answer is a deterministic pipeline of narrow agents behind a human validation gate, which helps reduce the volume of routine vulnerabilities a security team has to triage by hand.
Expert review still decides what counts as a finding. That gate is the whole difference between an accelerator for human researchers and a replacement for them.
The harder question is what happens to organizations that cannot build anything like this in-house. AVDH runs on a decade of Mandiant’s own consulting playbooks and proprietary benchmark codebases. Few security teams outside a handful of vendors can replicate either one.
Packaging that experience into Google AI Threat Defense, alongside CodeMender’s continuous scanning, is the more consequential move for most companies. Agentic vulnerability discovery looks set to arrive as another vendor-managed layer that most in-house teams buy rather than build.
