Google Mandiant AI agents find over 100 high-severity flaws in two days
This digest was compiled by AI from multiple sources — links to the originals are below.
Google Mandiant's internal AI agent chain finds over 100 verified high-severity vulnerabilities in two days during a live investigation into stolen corporate repositories. The Agentic Vulnerability Discovery Harness has been running inside Mandiant for ten months and has scanned tens of millions of lines of code. The tool has led to 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803.
Key Facts
- AVDH produced tens of thousands of findings and uncovered dozens of assignable flaws in widely used web extensions and open-source projects.
- Every confirmed finding goes to a Mandiant consultant before it counts.
- Mandiant consultants reproduce the exploit and run proof-of-concept code to confirm each flaw.
- The AVDH pipeline includes threat modeling, entry point discovery, context enrichment, hypothesis generation, and hypothesis validation.
- Mandiant researchers Alex Tselevich and Michael Maturi published the findings in a Google Threat Intelligence Group blog post.
Agentic Vulnerability Discovery Pipeline
AVDH runs as a sequence of specialised agents built on Google's Agent Development Kit. The pipeline includes threat modeling, entry point discovery, context enrichment, hypothesis generation, and hypothesis validation. Threat modeling maps the codebase and marks parts to skip, and a human reviews the resulting threat model before remaining stages proceed. Entry point discovery scans every file for places where user input enters the application, then context enrichment gathers permission checks and input sanitizers. Hypothesis generation agents look for access-control problems and dangerous data flows that lead to SQL injection, cross-site scripting, command injection, and path traversal.
Findings and CVEs
AVDH found over 100 verified high-severity vulnerabilities in two days during a live investigation into stolen corporate repositories. Over ten months, AVDH scanned tens of millions of lines of code and produced tens of thousands of findings, according to a blog post by Google Threat Intelligence Group. The tool uncovered dozens of assignable flaws in widely used web extensions and open-source projects. Mandiant researchers Alex Tselevich and Michael Maturi reported 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803, with an additional dozen in active disclosure.
Human Validation
Every confirmed finding goes to a person before it counts for anything. Mandiant consultants reproduce the exploit and run proof-of-concept code to check that the flaw is genuine and no overlooked control blocks it. Findings that fail that test are discarded. Mandiant researchers Alex Tselevich and Michael Maturi wrote: "We encourage network defenders considering implementing similar vulnerability discovery harnesses to manually validate findings." Automated code scanners have long had a reputation for noise — findings that look plausible on paper but do not hold up once checked.
1 source
Google Mandiant AI agents find over 100 high-severity flaws in two days
