On August 18, 2026, the Google Threat Intelligence Group publicly disclosed the architecture of the Agentic Vulnerability Discovery Harness (AVDH), a multi-agent system built on large language models that identified over 100 verified critical vulnerabilities in stolen enterprise source code repositories during a single two-day incident response engagement. The system has been operational internally at Mandiant for ten months and has generated tens of thousands of findings across tens of millions of lines of code, with 12 CVEs already assigned in web extensions and open-source projects and an equal number in active disclosure.
- AVDH discovered over 100 verified critical vulnerabilities in two days of analysis on stolen enterprise source code, during a specific incident response not further detailed.
- The architecture uses Google's Agent Development Kit (ADK) to orchestrate a sequential pipeline of specialized agents: Explorer, Threat Model Synthesis, Discovery, Enrichment, Access Control, Data Flow Analysis, and Validation.
- Every threat model requires human approval before proceeding; confirmed findings are passed to Mandiant consultants for manual validation with proof-of-concept.
- Mandiant built vulnerable synthetic codebases for internal benchmarking, avoiding public datasets potentially included in LLM training.
Why AVDH Breaks the Traditional Code Review Paradigm
The disclosure of AVDH upends a long-standing convention: that source code review remains an inherently human process, occasionally assisted by static scanners. Mandiant researchers Alex Tselevich and Michael Maturi, cited by Help Net Security, articulated this break explicitly: manual review cannot keep pace with AI, and traditional scanning engines systematically miss the broad spectrum of vulnerabilities hidden in modern software.
Mandiant's answer was not a single generic model, but an architectural harness: a containment and orchestration structure that imposes specific disciplines on otherwise indeterminate components. The ADK, Google's Agent Development Kit, serves as a deterministic layer that guarantees sequential agent execution and prevents unauthorized autonomous drift. The pipeline is designed to simulate, not replace, the reasoning of an expert researcher: each phase produces constrained output for the next, with high-temperature cross-validation checkpoints between independent agents.
"Manual source code review can't keep pace with AI, and traditional scanning engines consistently miss the broad spectrum of vulnerabilities hidden in modern software" — Alex Tselevich and Michael Maturi, Mandiant researchers
How the Pipeline Works: From Exploration to Human Handoff
The AVDH architecture comprises seven agents with distinct tasks, not a single generalist model. The Explorer agent maps the target codebase; the Threat Model Synthesis agent builds threat models; Discovery agents identify potential entry points; the Enrichment agent contextualizes each finding; the Access Control and Data Flow Analysis agents verify authorization controls and sensitive data flows respectively; finally, Validation agents execute high-temperature cross-checks to reduce the illusory coherence of individual LLMs.
A rigid architectural constraint permeates every phase: no threat model proceeds without human approval. This is not a post-hoc adjustment, but a structural requirement of the harness. Findings that pass automated cross-validation are transmitted to Mandiant consultants for manual verification with proof-of-concept and final risk rating. The process, documented in the official Google Cloud blog, explicitly includes discarding findings that fail this human validation. The source does not quantify the percentage of false positives filtered at this stage.
The Training Set Contamination Problem
An architectural detail reveals an unusual awareness of the circular limits of LLMs: Mandiant built vulnerable synthetic codebases for internal benchmarking and validation, deliberately avoiding public vulnerability datasets. The reason, implicit but clear, is that these datasets are likely already included in the training of frontier models, making tests based on them unreliable for measuring true generalization capabilities.
This architectural choice has consequences that extend beyond Google. If defenders can no longer trust public benchmarks to evaluate LLM-based vulnerability discovery tools, every security team wishing to replicate similar approaches must invest in proprietary synthetic datasets. The barrier to entry for agentic code security automation consequently rises, favoring actors with significant R&D resources.
Why It Matters
The dossier does not specify the nature of the data exposed in the stolen repositories analyzed over 48 hours, nor does it identify the client or sector involved in the incident. The false positive or false negative rate of AVDH as a whole is not quantified, and it is unclear whether the system will be released as a commercial product or remain an internal tool with only the architectural blueprint shared.
NVD records confirm the existence of CVE-2026-13242 (CVSS 6.5 MEDIUM) and CVE-2026-55803 (CVSS 5.9 MEDIUM), both relating to Drupal products, but do not mention AVDH or Google Mandiant in their description fields. The link between these identifiers and the AVDH pipeline therefore remains unverified on independent primary sources; Google and Help Net Security sources cite them as examples of CVEs assigned in the broader Mandiant program, without direct attestation of discovery via AI agents.
The exact LLM model used is not declared in primary sources, with a single partial exception: the Google Cloud blog mentions Gemini Flash Lite for the Discovery agents, leaving the other pipeline components undetermined. This disclosure gap affects the replicability of the architecture by external teams using different models.
The Researchers' Announcement: Automation with a Human Arbiter
Researchers Tselevich and Maturi formulated the program's central claim with a direct quote reported by Help Net Security: the harness's success demonstrates that defenders can regain advantage against adversarial AI by encapsulating frontier models within an expert-defined harness to automate routine vulnerability discovery. The same source reports the explicit recommendation to network defenders considering similar implementations: manually validate findings, an operational directive that mirrors the structural constraint already described in the AVDH architecture.
This recommendation is not generic: it is consistent with the system design made public, where human handoff is not optional but integrated. The difference between a free LLM analyzing code and an agentic harness lies precisely in this deterministic-probabilistic integration: ADK orchestration provides the structure, models provide pattern search, the operator provides the final risk decision.
FAQ
Is AVDH available as a commercial product?
No. At present, Google has released only the system's architectural blueprint. No commercialization roadmap or licenses for external use appear in public documentation.
Are the cited CVEs confirmed as discovered by AVDH?
NVD records for CVE-2026-13242 and CVE-2026-55803 do not mention AVDH or Google Mandiant. Primary sources cite them as examples of CVEs assigned in the Mandiant program, without direct attestation of discovery via the agentic pipeline.
What is the human operator's role in the system?
Human operators approve every threat model before the pipeline proceeds, and manually validate with proof-of-concept every finding confirmed by the final automated phase. No fully autonomous execution mode is documented.
Sources
- https://gbhackers.com/google-mandiant-ai-agents-find-over-100-critical-vulnerabilities/
- https://www.helpnetsecurity.com/2026/08/19/google-mandiant-avdh-ai-vulnerability-discovery-tool/
- https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review
- https://itwire.com/business-it-news/security/google-publishes-agentic-ai-blueprint-after-system-finds-100-critical-vulnerabilities-in-48-hours
- https://nvd.nist.gov/vuln/detail/CVE-2026-13242
- https://nvd.nist.gov/vuln/detail/CVE-2026-55803
- https://www.helpnetsecurity.com/2026/07/29/1password-ai-agent-governance/
Information verified against cited sources and current as of publication.