Google Threat Intelligence Publishes Its Multi-Agent Vulnerability Discovery Harness After Finding 100+ Bugs in Two Days

Not an attack. Mandiant's own agentic tooling, disclosed publicly for the first time

Google Threat Intelligence detailed the Agentic Vulnerability Discovery Harness, an orchestration of specialized AI agents that stage source-code analysis into threat modeling, attack-surface discovery, access-control analysis, and data and execution flow tracing, with a validation layer of independent agents assessing findings before human researchers confirm them through proof-of-concept testing. Over ten months of operation AVDH analyzed tens of millions of lines of code and contributed to 12 assigned CVEs with roughly a dozen more in disclosure. In one incident response investigation involving stolen corporate repositories it surfaced more than 100 true-positive critical vulnerabilities in two days. Google's stated reason for publishing was defensive parity: "exposure of proprietary source code can leave defenders racing against attackers capable of applying machine-speed AI analysis to stolen repositories," which reframes source-code theft as the opening move of an AI-accelerated exploitation timeline rather than an intellectual property loss

Not an incident. Recorded because it fixes a public benchmark for what agentic vulnerability discovery achieves against a real codebase, and because it states plainly that stolen source code is now an input to automated exploit development