Google Mandiant has introduced the Agentic Vulnerability Discovery Harness (AVDH), transitioning vulnerability research from rule-based scanning to autonomous agentic orchestration. By deploying multi-agent chains capable of LLM-driven semantic reasoning, AVDH executes complex code traversal and automated proof-of-concept (PoC) generation. In large-scale testing involving tens of millions of lines of code, the harness identified over 100 high-severity vulnerabilities within 48 hours. This capability fundamentally accelerates the vulnerability discovery lifecycle, drastically compressing the window between code deployment and exploitation, forcing a shift toward autonomous, AI-driven defensive orchestration to mitigate the risks posed by industrial-scale automated discovery.
- Research/Tooling Overview
- Transition from passive, rule-based automated scanning to active, autonomous agentic orchestration.
- Developed by Google Mandiant researchers following 10 months of internal operational refinement.
- Designed to address the necessity for intelligent, large-scale code analysis in modern environments.
- Methodology/Discovery Scope
- Employs multi-agent orchestration logic using agent chains for deep reasoning and complex code traversal.
- Utilizes LLM-driven semantic code analysis, offering significant improvements over traditional SAST/DAST methodologies.
- Capable of scanning massive-scale, distributed, or stolen corporate repositories.
- Key Findings/Technical Highlights
- Discovered 100+ verified, high-severity vulnerabilities within a concentrated 48-hour window.
- Integrated workflows for automated vulnerability verification and Proof-of-Concept (PoC) generation.
- Processed and analyzed tens of millions of lines of code during the testing phase.
- Industry/Defense Implications
- Rapidly collapses the "window of vulnerability" between flaw introduction and patch deployment.
- Accelerates a high-stakes arms race between AI-driven discovery and defensive response.
- Mandates that CISOs adopt autonomous orchestration to keep pace with AI-driven exploitation potential.
Related posts
- helpnetsecurity.com — Google’s AI security agents found 100+ critical software vulnerabilities in just two days
- news4hackers.com — Google’s AI Security Agents Uncover 100+ Critical Software Vulnerabilities in 48 Hours
- gbhackers.com — Google Mandiant AI Agents Find Over 100 Critical Vulnerabilities in Source Code Within Two Days
- Securitybrief
- Docs
- Apnews
- Cyberdaily
- Medium
- Securitybrief
- Cyfar
- SecurityWeek — Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace