Mandiant has published details of the multi-agent AI architecture it uses to uncover software vulnerabilities, as security teams face increasing pressure to identify flaws before AI-equipped attackers can exploit them.
The company’s Agentic Vulnerability Discovery Harness (AVDH) orchestrates specialised artificial intelligence agents to analyse source code, develop threat models, trace data and execution paths, and test potential vulnerabilities.
Google Threat Intelligence Group said the architecture was being detailed publicly for the first time to help defenders implement similar vulnerability discovery approaches within their own environments.
AVDH has already been deployed in incident response, penetration testing, proactive security reviews and red-team engagements.
In one incident response investigation involving stolen corporate repositories, the technology discovered more than 100 true-positive critical vulnerabilities in two days.
Mandiant said it had also used AVDH to analyse tens of millions of lines of code and run thousands of analysis pipelines over the 10 months the technology has been in operation.
The work has contributed to 12 assigned CVEs, with a further dozen vulnerabilities currently in active disclosure.
AI agents examine code in stages
AVDH differs from conventional source code scanning by attempting to replicate elements of the methodology used by human vulnerability researchers.
Google said traditional source code review engines typically depend on rigid pattern matching, whereas large language models can analyse contextual factors such as whether code can be accessed by a standard user, requires administrator privileges or is never executed.
The AVDH workflow starts by building a threat model.
An Explorer agent determines the purpose of the target codebase, reviews available documentation and identifies areas that should be included or excluded from analysis.
Specialist agents subsequently examine authentication, authorisation, routing and other application-specific areas before their findings are consolidated.
The threat model is presented to a human consultant for approval before deeper analysis begins.
Discovery agents then process files in parallel to identify attack surfaces including HTTP routes and inter-process communication listeners, as well as sources of user-controlled input.
Additional agents collect surrounding code to determine how permissions, sanitisation and routing conditions affect potential vulnerabilities.
AVDH then separates its analysis between access control and data flow.
The former looks for issues such as missing authorisation, privilege escalation and cross-site request forgery, while the latter traces user-controlled data through the application to identify vulnerabilities such as SQL injection, cross-site scripting and command injection.
Agents asked to challenge findings
A key part of the architecture is an additional validation stage designed to challenge the AI’s initial conclusions.
Multiple Validation agents independently assess each vulnerability hypothesis, after which a Synthesis agent compares their reasoning and makes a final determination.
Findings can be confirmed, disproven by conflicting evidence, or rejected because they do not fit the threat model or qualify as a vulnerability.
Confirmed vulnerabilities are deduplicated and risk-rated before being passed to Mandiant specialists.
Researchers then attempt to reproduce the exploit and execute proof-of-concept code to confirm that the vulnerability is genuine and that other security controls do not prevent the attack.
Any finding that fails the human testing process is discarded.
Mandiant has also incorporated rules derived from the experience of its security consultants into the AI pipeline in an attempt to reduce vulnerabilities being missed.
The rules are organised around software domains, programming languages, frameworks and particular vulnerability types.
Source code becomes an AI battleground
The development comes as generative AI increasingly changes the economics of vulnerability research for both attackers and defenders.
GTIG warned that exposure of proprietary source code can leave defenders racing against attackers capable of applying machine-speed AI analysis to stolen repositories.
The group said securing the software development pipeline had consequently become a critical component of enterprise defence.
AVDH is intended for deep, point-in-time analysis rather than continuous software monitoring.
Google said organisations could combine that type of targeted assessment with continuous scanning to create a two-layer approach to software security.
AVDH itself is built using Google’s Agent Development Kit, with its agents executed through deterministic workflows rather than being given unrestricted autonomy.
According to GTIG, the approach demonstrates the importance of combining frontier AI models with human-defined security methodologies and validation.
The company said the objective was to automate the discovery of more routine vulnerabilities while allowing human researchers to concentrate on complex flaws and exploit chains.
