Mandiant's Agentic Vulnerability Discovery Harness Found 100+ Bugs in 48 Hours

Google’s Mandiant published a detailed technical breakdown of the tool behind one of the more eyebrow-raising numbers in AI-assisted security research this year: over 100 true-positive critical vulnerabilities, found in stolen corporate source code, in two days. The tool is called the Agentic Vulnerability Discovery Harness, AVDH for short, and Mandiant has now been running it operationally for ten months. The write-up matters less for the headline figure than for what it reveals about how a serious AI vulnerability-hunting pipeline actually has to be built to avoid drowning consultants in noise.

What AVDH actually is

AVDH is not a single model pointed at a codebase with instructions to “find bugs.” It’s a sequential, multi-agent pipeline built on Google’s Agent Development Kit, and the architecture reads more like a waterfall software process than a chatbot wrapper. That’s deliberate. Mandiant’s engineers found that a single-pass scan produces either shallow findings or an unmanageable flood of false positives, so the harness breaks the problem into six distinct phases, each with its own agent roles and its own quality gates.

The pipeline starts with threat modeling. An Explorer agent maps the codebase’s purpose and domain, then hands off to specialist subagents that dig into authentication, authorization, routing, and other domain-specific areas. A synthesis agent aggregates all of that into a coherent threat model, which a human consultant has to approve, in both textual and visual form, before the pipeline moves forward. That approval gate is the first of several places where AVDH deliberately slows itself down.

From there, entry point discovery uses a lightweight model, Gemini Flash Lite, to extract HTTP routes, IPC listeners, and other attack surface at scale across every in-scope file. Context enrichment agents then trace each entry point through the codebase, following sanitizers, permission checks, and routing conditions across function calls and file boundaries, work that’s genuinely tedious for a human reviewer and exactly the kind of thing agentic tooling should be good at.

Where hypotheses get made, and unmade

The hypothesis generation stage is where AVDH starts producing actual candidate vulnerabilities. An Access Control agent checks entry points for missing authorization, privilege escalation paths, and CSRF gaps. A separate Data Flow Analysis agent traces user input across the application looking for dangerous sinks, the kind of tracing that turns up SQL injection, XSS, command injection, and path traversal. Consultants tune a confidence filter here to manage volume, because at this stage the system is still generating far more candidates than will survive scrutiny.

Here’s the part that’s easy to gloss over but does most of the work: hypothesis validation runs multiple agents at high temperature, deliberately configured to explore different angles on the same candidate rather than converge quickly, and a synthesis agent then weighs their reasoning against each other. Each hypothesis ends up confirmed, disproven by conflicting evidence, or rejected outright as not matching the threat model. Only confirmed findings reach a human.

And even confirmed findings don’t get trusted on the AI’s word. Mandiant consultants reproduce the exploit and run proof-of-concept code against every finding before it’s treated as real. Anything that fails dynamic testing gets discarded, no matter how convincing the agent’s reasoning looked on paper. That’s a meaningfully different posture from tools that ship an AI-generated finding straight into a ticket queue.

The numbers, and where they came from

The headline incident response case involved analyzing stolen repositories to understand what an attacker with access to that source could actually exploit, and the harness produced its 100-plus critical, true-positive findings against that codebase in 48 hours. Zoom out to the full ten-month deployment and the scale is larger: tens of millions of lines of code processed, thousands of pipeline runs, tens of thousands of total findings generated. Twelve of those have become assigned CVEs, including two in Drupal (CVE-2026-13242 and CVE-2026-55803), with roughly a dozen more currently working through disclosure.

Mandiant also describes how it keeps the system from overfitting to its own training data or drifting off in quality over time. Rather than testing against public codebases the underlying models may have already seen, the team builds proprietary synthetic benchmarks with manually verified, genuinely reachable, dynamically exploitable vulnerabilities injected across different domains, languages, and architectures. A grading agent checks new findings against that ground truth, with secondary agents specifically tasked to triage false positives and resolve duplicate clusters, and results get averaged across runs to account for the non-determinism inherent to LLM output.

Defensive guidance

Mandiant’s public framing is explicitly a two-layer model: an AVDH-style harness for deep, point-in-time analysis of complex vulnerability chains, paired with continuous scanning (Google points to its CodeMender tooling) for ongoing monitoring during active development. If you’re evaluating agentic code review tools for your own environment, the architecture here is instructive even if you never touch Mandiant’s specific product.

A few things worth taking from this if you’re building or buying similar capability. First, single-pass AI scanning without a validation stage is going to generate a false positive rate your team won’t tolerate for long; the multi-stage hypothesis generation and validation split is doing real work, not just adding latency for its own sake. Second, human approval gates need to sit at the stages where errors compound, threat model construction being the obvious one, not just at the very end of the pipeline. Third, if you can’t build synthetic benchmarks that avoid contaminating the evaluation with data the model may have already trained on, you don’t actually know your false positive and false negative rates, you’re guessing.

The uncomfortable symmetry here is worth sitting with. The same agentic pipeline structure that let Mandiant find 100 critical bugs in two days is architecturally identical to what a well-resourced adversary would build to find the same bugs first. Mandiant is publishing this blueprint partly because it assumes attackers are already building comparable tooling, disclosure at this point buys defenders parity rather than secrecy. Whether your organisation has the engineering capacity to stand up something like this internally, or needs to lean on a vendor who already has, is a budget conversation worth having before an incident forces it.

Sources

• Staying Ahead of Adversarial AI Through Agentic Source Code Review — Google Cloud Blog
• Google’s AI security agents found 100+ critical software vulnerabilities in just two days — Help Net Security
• Mandiant Opens Agentic Security Harness to Industry — BankInfoSecurity