Scaling Defenses via Google's Agentic Orchestration and AVDH Framework

Google Cloud and Mandiant have developed the Automated Vulnerability Discovery Harness (AVDH) and the Agent Development Kit (ADK) to counter machine-speed adversarial AI. By employing "Agentic Orchestration" using Gemini Flash Lite as a reasoning engine, this framework automates complex vulnerability discovery across massive codebases. The system utilizes a hierarchical rule set to deploy specialized agents for reconnaissance, data-flow analysis, and non-deterministic validation. This approach identified over 100 critical true-positive vulnerabilities and 12 CVEs, including CVE-2026-13242 and CVE-2026-55803, within 48 hours, significantly reducing the discovery window compared to traditional manual review.

• Research/Tooling Overview: The Shift to Agentic Defense

  • Transitioning from rigid pattern-matching and manual review to "Agentic Orchestration" using LLMs as core reasoning engines.
  • Deployment of the Google Agent Development Kit (ADK) to implement structured, deterministic agentic patterns.
  • Utilization of Google Antigravity for centralized workspace management of complex, multi-agent security workflows.

• Methodology: The Hierarchical Agentic Pipeline

  • Implementation of a structured rule system organized by Software Domain $\rightarrow$ Language/Framework $\rightarrow$ Vulnerability Type.
  • Deployment of Explorer and Discovery Agents (utilizing Gemini Flash Lite) for high-scale entry point and user-input extraction.
  • Integration of Enrichment and Access Control Agents to navigate nested function calls and map distributed data flow and sanitizer logic.
  • Employment of High-Temperature Validation Agents for expansive, non-deterministic testing of vulnerability hypotheses.

• Key Findings: Automated Discovery at Scale

  • Identified 100+ true-positive critical vulnerabilities within a compressed 48-hour operational window.
  • Achieved attribution of 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803, via automated discovery pipelines.
  • Processed tens of millions of lines of code through thousands of concurrent pipelines to generate massive-scale findings.
  • Utilization of synthetic codebase benchmarking and Grading Agents to prevent model overfitting and ensure high-fidelity evaluation.

• Defense Implications: Human-AI Augmentation Strategy

  • Shifting the SOC paradigm from reactive manual investigation to proactive, agent-driven hypothesis generation.
  • Leveraging AI as a "practical multiplier" to automate the discovery of routine vulnerabilities.
  • Enabling human experts to focus exclusively on high-complexity, high-impact architectural flaws requiring nuanced intuition.