Google’s Breakthrough in AI-Powered Vulnerability Discovery
AI vulnerability discovery is rapidly transforming the world of cybersecurity and secure software development. Recently, Google’s security arm Mandiant unveiled details about its internal tool, Agentic Vulnerability Discovery Harness (AVDH), which leverages chains of AI agents to scour source code for flaws. In a remarkable demonstration, AVDH identified over 100 verified, high-severity vulnerabilities in just two days during a live investigation of stolen corporate repositories.
Over the past ten months, AVDH has been an integral part of Mandiant’s operations. According to a blog post from the Google Threat Intelligence Group, the tool has scanned tens of millions of lines of code and generated tens of thousands of findings. It has uncovered numerous assignable vulnerabilities in popular web extensions and open-source projects, resulting in 12 new CVEs, including CVE-2026-13242 and CVE-2026-55803, with many more flaws still undergoing disclosure processes.
How the AVDH Pipeline Functions
The foundation of AVDH lies in its multi-agent pipeline, built on Google’s Agent Development Kit. Each stage of the pipeline is handled by a specialized AI agent, with each agent passing its output to the next. This chain ensures a thorough and systematic approach to AI vulnerability discovery:
- Threat Modeling: The initial agent analyzes the codebase, identifies the type of software, and marks sections to skip, such as test directories. A human expert reviews this threat model before proceeding.
- Entry Point Discovery: The next set of agents examines all in-scope files to detect where user input enters the application, from web routes to inter-process listeners.
- Context Enrichment: For each entry point, an agent gathers related code—like permission checks and input sanitizers—that would otherwise require manual hunting.
- Hypothesis Generation: Separate agents search for access-control issues (e.g., missing authorization or privilege escalation) and dangerous data flows, such as those leading to SQL injection, XSS, command injection, or path traversal.
- Hypothesis Validation: Multiple agents, each set to high “temperature” to broaden their reasoning, assess each hypothesis. A synthesis agent then categorizes findings as confirmed, disproven, or rejected.
Even after a finding is confirmed by the AI pipeline, it is handed over to a human consultant for final validation. Mandiant consultants reproduce exploits and test proof-of-concept code to ensure any flaw is genuine and not blocked by existing controls. If a vulnerability cannot be reproduced, it is discarded.
Reducing False Positives in Automated Code Scanning
One of the enduring challenges of automated security tools is noise—false positives that seem plausible but do not hold up under scrutiny. AVDH was designed to combat this by having its AI agents rigorously challenge each other’s conclusions and compare findings against a comprehensive set of rules authored by Mandiant’s own experts. These rules are organized by software domain, language, framework, and vulnerability type, enhancing their reusability across different projects and codebases.
To fairly assess AVDH’s accuracy, Mandiant developed synthetic, intentionally vulnerable codebases for internal testing. This mitigates the risk that the AI could simply recall solutions from public vulnerability datasets it may have encountered during training, ensuring genuine reasoning over simple pattern recognition.
The Growing Importance of AI in Securing the Software Pipeline
Mandiant researchers emphasized that securing the software development pipeline has become a defining challenge for modern enterprises. In today’s threat landscape, the speed and complexity of new exploits mean that manual code reviews and traditional static analysis tools often cannot keep up. AI vulnerability discovery tools like AVDH are crucial for identifying the broad spectrum of vulnerabilities hidden in contemporary codebases.
By embedding advanced AI models within a framework defined by security experts, defenders can automate the detection of both common and subtle vulnerabilities. This approach helps organizations reclaim the advantage against adversarial AI and sophisticated attackers, making the software supply chain more resilient.
Looking Ahead: The Future of Automated Security
Google’s success with AVDH underscores the potential of AI vulnerability discovery to revolutionize cybersecurity practices. As attackers leverage AI to find and exploit weaknesses, defenders must adopt equally advanced tools to stay ahead. Mandiant’s work demonstrates that, with careful human oversight and expert-driven rules, AI can dramatically reduce risks and improve the security posture of software projects worldwide.
This article is inspired by content from Original Source. It has been rephrased for originality. Images are credited to the original source.