Mandiant’s AI agents unearth 100+ critical flaws in stolen code in two days

August 19, 2026. The Google Threat Intelligence Group published the inner workings of a tool Mandiant has run for ten months to hunt vulnerabilities in source code. More than 100 verified critical flaws in two days during an investigation into stolen corporate repositories. 12 CVEs already assigned, including CVE-2026-13242 and CVE-2026-55803, with another dozen in active disclosure.

What matters here is not one more tool. It is the shift the numbers illustrate: manual code review can no longer keep pace with AI, and traditional scanners miss too many flaws — but a well-built agent harness can, for once, reclaim the advantage.

AVDH: a chain of agents, not a scanner

The tool is called AVDH, short for Agentic Vulnerability Discovery Harness. It is presented not as a scanner but as a chain of specialized agents built on Google’s Agent Development Kit, each handing its output to the next. In ten months it has scanned tens of millions of lines of code and produced tens of thousands of findings.

The numbers that give it scale: more than 100 verified high-severity flaws in two days on a live investigation, dozens of assignable flaws in widely used web extensions and open-source projects, and 12 CVEs published — with, according to researchers Alex Tselevich and Michael Maturi, “an additional dozen currently in active disclosure.”

The chain, stage by stage

AVDH’s strength lies less in its models than in its architecture. The pipeline breaks into five stages, each with a dedicated agent.

• Threat modeling: an agent maps the codebase, figures out what kind of software it is, and marks which parts to skip, such as test directories. A human reviews the threat model before anything else happens — the front door is controlled.
• Entry point discovery: agents scan every file to find where user input enters the application, from web routes to inter-process listeners.
• Context enrichment: for each entry point, an agent gathers the scattered relevant code — permission checks, input sanitizers — that a human reviewer would otherwise have to chase down by hand.
• Hypothesis generation: separate agents look for access-control problems (missing authorization, privilege escalation, CSRF) and dangerous data flows (SQL injection, XSS, command injection, path traversal).
• Hypothesis validation: several agents, deliberately run at high temperature to widen their reasoning, weigh in on each hypothesis; a synthesis agent sorts each one into confirmed, disproven, or rejected.

The decisive point is the human loop. Every confirmed finding goes to a consultant: Mandiant reproduces the exploit and runs proof-of-concept code to check the flaw is genuine and that no overlooked control blocks it. Findings that fail that test are thrown out.

The fight against false positives

Automated scanners carry a well-earned reputation for noise: findings that look plausible on paper but do not hold up once someone checks. AVDH was built specifically against that flaw, by having agents challenge each other’s conclusions and checking them against rules written by Mandiant’s own consultants, rather than flagging code patterns that merely resemble known bugs.

Those rules are organized by software domain, then split into three groups — language, framework, and vulnerability type — so the knowledge stays reusable as the tool is pointed at different codebases.

One methodological detail deserves attention: to grade its own performance, Mandiant built synthetic, deliberately vulnerable codebases rather than relying on public vulnerability datasets. The reason is blunt: today’s models may have already seen those datasets in training, and “remember” an answer instead of reasoning through it. That is the mark of a team measuring honestly what AI can actually do.

Where AVDH sits against classic scanners

To place the contribution, compare it to the two historical families. SAST (static analysis) walks the code looking for known patterns: fast, but blind to data flows that cross files. DAST (dynamic analysis) tests the running application: it sees input and output, but not the internal path. AVDH occupies a third place: it reasons over the code the way a human reviewer would, forming hypotheses about what could go wrong, then verifying them through exploitation.

The difference lies in what Mandiant calls the fight against adversarial AI. Attackers already use models to write exploits, hunt for flaws, and chain vulnerabilities — and they do it at model speed, not human speed. The defender’s answer cannot stay a pattern scanner running once a week: it has to be a harness capable of generating and verifying hypotheses at the same pace. That is exactly what the figure of 100+ critical flaws in two days demonstrates — at that cadence, a human alone, or a classic scanner, is out of the race.

What it changes for defenders

Google’s conclusion pulls no punches: “securing the software development pipeline has emerged as a defining challenge in modern enterprise defense,” and “manual source code review can’t keep pace with AI.” The counterpoint is just as clear: “the success of our harness proves defenders can reclaim the advantage against adversarial AI,” by embedding frontier models within an expert-defined harness.

For a CISO or AppSec lead, the takeaway comes down to three points. First, the value is in the orchestration, not the model: the agent chain, the domain rules, and the human loop make the difference, not the model’s size. Second, the false positive remains the enemy: human validation by proof-of-concept is what separates a useful tool from a ticket generator. Third, the synthetic codebase as an evaluation yardstick is a practice worth copying: if your metric rests on contaminated public datasets, you are measuring memorization, not discovery.

For security teams, the deeper implication is organizational. The bottleneck in vulnerability discovery is shifting from raw review throughput — where AI already wins — to verification and triage, where a human must still reproduce an exploit before it counts. That inversion has a concrete consequence: a team that spends its analysts’ time re-reading code by hand is competing against an opponent that automates the same work in minutes. The teams that pull ahead will be the ones whose analysts spend their hours validating machine-generated hypotheses — exactly the loop AVDH is built around. And for open-source maintainers, the twelve CVEs and counting are a preview: the next wave of disclosure is likely to arrive from agentic harnesses, not from a lone researcher with a weekend and a fuzzer.

Verdict

AVDH is not a product you can buy — it is a capability Mandiant keeps in-house. The decision is therefore indirect: if you are evaluating AI-assisted code review tools, demand the same proof Google gives — actually assigned CVEs, human validation by exploit, and an uncontaminated evaluation yardstick. If your vendor publishes neither, you are buying a review assistant, not a vulnerability finder.

The question is no longer whether AI can find flaws. It is whether your team has the harness — and the human loop — to turn a hypothesis into a CVE.

References

• Google Threat Intelligence Group, “Staying ahead of adversarial AI through agentic source code review,” cloud.google.com, August 19, 2026.
• Help Net Security, “Google’s AI security agents found 100+ critical software vulnerabilities in just two days,” August 19, 2026.
• NVD, CVE-2026-13242 and CVE-2026-55803 records, accessed August 20, 2026.