Mandiant AI Agents Found 100 Critical Flaws in 2 Days

Mandiant, part of Google Cloud, has spent ten months running an internal AI system called the Agentic Vulnerability Discovery Harness against real client code. On August 19, 2026 the team published the architecture publicly for the first time, along with a result that explains why: during an incident response investigation into stolen corporate repositories, AVDH surfaced more than 100 verified critical vulnerabilities in two days.

• AVDH has scanned tens of millions of lines of code over ten months, generating tens of thousands of candidate findings
• The two-day investigation produced 100+ true-positive critical vulnerabilities
• Twelve CVEs have been assigned so far, including CVE-2026-13242 and CVE-2026-55803, with roughly a dozen more disclosures in progress
• Every confirmed finding is manually validated by Mandiant consultants who reproduce the issue and build proof-of-concept code

How Is AVDH Different From a Code Scanner?

This is the part worth slowing down on. A traditional static analysis engine pattern-matches. AVDH is a sequential pipeline of specialised LLM agents wrapped in deterministic orchestration and expert-defined security methodology, and the stages mirror how a human application security consultant actually works.

The pipeline runs threat modeling first, with a human review checkpoint. Then entry point discovery, then context enrichment, then hypothesis generation, then hypothesis validation with human verification. The output is a prioritised, risk-rated finding list for people to confirm, not an autonomous patch stream. That design choice is the reason the numbers are credible: the 100+ figure counts true positives that consultants reproduced, not raw alerts.

Why Google Published the Blueprint

The stated reasoning is defensive parity. Mandiant researchers argue that manual source code review can no longer keep pace with AI-assisted analysis, and that traditional scanning engines consistently miss the classes of bug that matter most. If attackers are already pointing agent pipelines at stolen source, defenders reviewing the same code by hand are structurally behind.

Publishing the architecture rather than the tool is a deliberate middle path. Other teams get the design pattern, the stage decomposition, and the human-in-the-loop checkpoints without Google shipping a weapon. It follows the same instinct behind other recent AI security research disclosures, including Anthropic's Project Glasswing work uncovering decade-old vulnerabilities.

What Security Teams Should Take From This

Three things translate directly. First, the human checkpoints are not ceremony — they are what keeps the false positive rate low enough that the output is actionable. Second, threat modeling as stage one matters enormously, because an agent that knows what it is looking for outperforms one told to find anything wrong. Third, ten months of internal operation before publication is the kind of runway that separates a demonstration from a working process.

The responsible disclosure track record is the other quiet signal here. Twelve assigned CVEs with a dozen more in flight means findings are going through coordinated disclosure rather than being stockpiled, which is the behaviour you want from anyone operating discovery tooling at this scale. Mandiant has been building toward this for a while, as our coverage of its AI-powered agentic SOC noted earlier this year.

For defenders, the encouraging read is straightforward: the same capability that worries people when adversaries hold it is now documented well enough for security teams to build their own version. That is a good trade.

Sources: Google Cloud Blog — August 2026; Help Net Security — August 19, 2026; GovInfoSecurity — August 2026.