Google's Mandiant says its AI-agent pipeline found 100+ critical flaws in two days

Google Cloud’s Mandiant unit said an internal AI-agent pipeline found more than 100 critical, true-positive vulnerabilities in two days during a live incident-response investigation, in a disclosure published August 18, 2026. The tool, called the Agentic Vulnerability Discovery Harness, or AVDH, had been running quietly inside Mandiant for 10 months.

The two-day burst came while Mandiant was investigating stolen corporate source-code repositories. Over the full 10-month run, AVDH scanned environments spanning tens of millions of lines of code, executed thousands of pipelines and produced tens of thousands of findings, resulting in 12 assigned CVE (Common Vulnerabilities and Exposures) identifiers, including CVE-2026-13242 and CVE-2026-55803, with about a dozen more in active disclosure, the company said in a blog post from its Google Threat Intelligence Group.

AVDH chains several AI agents through a sequential pipeline: threat modeling with human review, entry-point discovery, context enrichment, hypothesis generation and hypothesis validation, built on Google’s Agent Development Kit. To limit false positives, agents are made to challenge each other’s conclusions against rules written by Mandiant consultants. The system has also surfaced remote-code-execution flaws that enabled initial access in client web applications, Mandiant said.

The figures are the company’s own and have not been independently verified. Vendor vulnerability counts are hard to compare, and “critical” and “true-positive” are Mandiant’s own labels; the 12 CVEs are the checkable part.

“Manual source code review can’t keep pace with AI, and traditional scanning engines consistently miss the broad spectrum of vulnerabilities hidden in modern software,” the post said. The claim doubles as a sales pitch for what agentic code review can do.