On August 18, 2026 Alex Tselevich and Michael Maturi of Mandiant, part of Google Cloud, published the architecture of the Agentic Vulnerability Discovery Harness, an internal tool the firm has run for ten months across proactive reviews, penetration tests, red team operations and incident response. The stated reason for publishing is defensive parity: attackers are already using models to analyse code at speed, so Mandiant is describing the design so other security teams and open-source maintainers can build their own.
AVDH is a deterministic, waterfall-style pipeline of specialised agents rather than a single model asked to find bugs. A threat-modelling stage uses an Explorer agent and specialist subagents for authentication, authorisation and routing, and a human consultant must approve the resulting threat model before anything proceeds. Entry-point discovery runs in parallel on Gemini Flash Lite to extract HTTP routes, IPC listeners and domain-specific attack vectors. A per-entry-point enrichment agent then gathers relevant code and routes it to an Access Control agent, a Data Flow Analysis agent, or both, which generate hypotheses about missing authorisation, privilege escalation, CSRF, injection or path traversal. Validation agents run at high temperature for breadth, a synthesis agent adjudicates, and every surviving finding goes to a human who must reproduce the exploit with proof-of-concept code; findings that fail that step are discarded. A rules layer injects Mandiant’s own domain, language and framework expertise at the appropriate stages, and the whole thing is built on Google’s Agent Development Kit.
The numbers Mandiant reports are its own. Across ten months it says AVDH has processed codebases spanning tens of millions of lines, run thousands of pipelines, produced tens of thousands of findings, and yielded 12 assigned CVEs including CVE-2026-13242 and CVE-2026-55803, with about another dozen in active disclosure. The headline case is an incident response engagement on stolen corporate repositories in which the harness surfaced more than 100 true-positive critical vulnerabilities in two days. Notably, the post publishes no precision, recall or false-positive rate, and it acknowledges that public vulnerability datasets may be memorised by frontier models, which is why Mandiant benchmarks against proprietary synthetic sets instead.
For a technical leader the transferable content is the harness, not the model. The design choices that make this credible are the ones that constrain the AI: fixed stage boundaries, a human gate on the threat model, a confidence filter to control hypothesis volume, and a mandatory human exploit reproduction before anything counts as a finding. Mandiant is explicit that AVDH is point-in-time rather than continuous, and that it needs rich context - asset inventories, SBOMs, architecture documentation - to perform. Read against the same week’s evidence that a single researcher can go from bug to working exploit in a day, the asymmetry is uncomfortable: the defensive version of this capability requires expert orchestration and expert validation, while the offensive version does not.