Google Cloud unveils AI harness that finds flaws fast

Google Cloud has disclosed details of its internal Agentic Vulnerability Discovery Harness for source code review, a system Mandiant uses in security assessments and incident response work.

The framework combines multiple AI agents with human expert review to identify exploitable software flaws in large codebases. Over the past 10 months, it has been used in proactive code reviews, penetration tests, red team operations and investigations following source code theft.

Google Cloud said the most striking result came during an incident response case involving stolen corporate repositories. In that engagement, the harness found more than 100 true-positive critical vulnerabilities in two days, far faster than a manual review, the company said.

Mandiant has also applied the system in software environments containing tens of millions of lines of code. The process has generated thousands of analysis pipelines and tens of thousands of findings, according to Google Cloud.

Those reviews have uncovered dozens of flaws in web extensions and open-source projects, with 12 Common Vulnerabilities and Exposures identifiers assigned so far. Google Cloud cited CVE-2026-13242 and CVE-2026-55803 among the issues already disclosed and said about a dozen more remain in active disclosure.

How it works

The harness is designed as a sequential pipeline rather than a single prompt to a large language model. That structure is intended to make the process more predictable and reduce the erratic behaviour that can arise when AI models are used without controls, Google Cloud said.

The first step is threat modelling. An initial explorer agent identifies the software domain, reviews documentation and marks directories that should be excluded, such as unit tests, before specialist subagents examine areas including authentication, authorisation and routing.

A synthesis agent combines those findings into a threat model for a human consultant to verify. Only after that approval does the broader analysis continue.

The next phase examines every file in scope to identify entry points such as HTTP routes and inter-process communication listeners, along with sources of user input. Other agents then gather the surrounding code, including sanitisers, permission checks and nested function calls, so later analysis does not treat an entry point in isolation.

Google Cloud said the framework splits deeper inspection into control-flow and data-flow analysis. One set of agents looks for access-control errors such as missing authorisation, privilege escalation and cross-site request forgery. Another traces user input through the application to see whether it reaches dangerous functions linked to issues such as SQL injection, cross-site scripting, command injection and path traversal.

Human checks

AI-generated hypotheses are then tested by several validation agents before a synthesis stage determines whether a flaw is confirmed, disproven or rejected, Google Cloud said. Confirmed findings are risk-rated and deduplicated before human reviewers try to reproduce the exploit and test proof-of-concept code.

According to Google Cloud, that human step is central because it removes false positives and catches cases in which the model has made incorrect assumptions. Findings that do not survive dynamic testing are discarded.

The framework also incorporates what Google Cloud described as distilled human knowledge. Mandiant consultants have created structured rule sets covering software domains, programming languages, frameworks and specific vulnerability types, which are fed into the pipeline to improve analysis and reduce missed issues.

That means the system does not rely only on generic model reasoning. Instead, it is guided by accumulated specialist knowledge about where entry points are usually defined, how particular frameworks behave and how certain classes of flaw should be discovered and validated.

Broader strategy

Google Cloud positioned the disclosure as a response to the growing use of AI by attackers. Defenders face pressure when proprietary code is exposed because attackers can apply automated tools at machine speed while security teams race to understand what has been stolen and where exploitable weaknesses may lie, the company said.

It also argued that the approach addresses limits in both manual review and conventional scanning engines. Manual code review can be slow and expensive across modern codebases, while static tools often struggle to capture business logic, execution reachability and the context around privileged versus public-facing functions.

The architecture uses Google's Agent Development Kit for orchestration, and Google Cloud linked the approach to its broader work on managing agent-based workflows. It said the system is a point-in-time architecture rather than a continuously running service.

To evaluate the system, Google Cloud said it built internal synthetic codebases rather than relying on public vulnerability datasets that may already have been absorbed into model training data. Human experts verify the injected flaws in those benchmarks, and a grading process compares the system's findings against known ground truth before manual review checks the results.

A recent client engagement illustrated the offensive testing use case. Google Cloud said the harness processed a customer's web application source code and quickly uncovered a remote code execution vulnerability that provided an initial route into the target environment.

"By embedding frontier models within an expert-defined harness, defenders can automate the discovery of routine vulnerabilities," said Alex Tselevich and Michael Maturi, authors of the post.