Mandiant turns AI code review into a gated workflow
Google Cloud Threat Intelligence has described AVDH, an internal Mandiant system that uses agentic AI to review source code during proactive assessments, red team work and incident response. The post frames the harness as a defensive answer to adversarial AI, especially when stolen corporate repositories give attackers a map of software weaknesses. Google says the system has produced measurable results, including more than 100 true-positive critical vulnerabilities in two days during one incident response case. The important detail is not only speed, but the way Mandiant says the pipeline forces AI output through threat modeling, validation and human expert review.Why AVDH is being presented now
Google says adversarial misuse of AI has increased the risk around exposed proprietary source code because attackers can analyze leaked repositories quickly while defenders race to identify and patch exploitable flaws. AVDH, short for Agentic Vulnerability Discovery Harness, is Mandiant's internal framework for rapidly analyzing code and finding exploit paths in authorized security work.The company says it is sharing the point-in-time architecture for the first time so defenders can understand how a structured AI review pipeline can be built. That positioning matters because the post does not describe a general chatbot doing open-ended review. It describes a controlled workflow that uses multiple specialized agents, explicit gates and security-consultant expertise to reduce the chance that model output becomes unreviewed noise.
How the pipeline narrows a large codebase
AVDH begins by building a threat model before vulnerability analysis starts. According to Google, an Explorer agent identifies the purpose and domain of the target codebase, reviews available documentation, excludes directories such as unit tests where appropriate, and dispatches specialist subagents for areas including authentication, authorization and routing.That threat model is then synthesized and shown to a consultant in textual and visual form for verification before the pipeline continues. The approval gate is a practical control: if the system misunderstands what is exposed, what is privileged or what is never executed, later findings may be irrelevant.
After the threat model is approved, parallel Discovery agents analyze in-scope files. Google says these agents use Gemini Flash Lite to extract entry points such as HTTP routes, inter-process communication listeners and other domain-specific attack vectors, while also identifying user input sources inside those paths. Enrichment agents then gather related code across files, functions, sanitizers, permissions and routing conditions so each entry point is reviewed with enough context.
Validation is built to challenge AI assumptions
The harness separates hypothesis generation from validation. Access Control agents examine whether privileged functionality is properly restricted, while Data Flow Analysis agents trace user-supplied input through nested calls, transformations and storage boundaries toward dangerous sinks associated with vulnerability classes such as SQL injection, cross-site scripting, command injection and path traversal.Google says this early stage is intentionally broad, with a consultant-configured Confidence Filter used to manage the volume of hypotheses. The validation stage then uses multiple Validation agents with higher temperature settings to test each hypothesis from varied angles, followed by a Validation Synthesis agent that decides whether the issue is confirmed, disproven or rejected as out of scope or not a vulnerability.
The final step is human review. Mandiant says confirmed findings are deduplicated and risk-rated, then consultants dynamically verify the attack path and check for compensating controls before preparing formal disclosure. Findings that fail this phase are discarded. The implication for defenders is clear: agentic code review may accelerate discovery, but Google is not presenting it as a replacement for expert validation.
Reported results show speed, with attribution needed
Google reports that Mandiant has used AVDH for 10 months and has seen significant impact. In one recent incident response investigation involving stolen corporate repositories, the harness allegedly found more than 100 true-positive critical vulnerabilities in two days, which Google says was a fraction of the time required for manual review.The post also says Mandiant has used AVDH across environments spanning tens of millions of lines of code, executing thousands of pipelines and generating tens of thousands of findings. Google says this work uncovered dozens of assignable flaws in widely used web extensions and open-source projects, resulting in 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803, with an additional dozen issues in active disclosure.
These are self-reported results from the system's operator, not an independent benchmark published by a third party. Still, the details are newsworthy because they show how a major incident response and threat intelligence organization is operationalizing agentic AI in source review rather than limiting it to advisory or experimental use.
Benchmarking addresses a known LLM problem
Google says it built an internal benchmarking process because public vulnerability datasets can be contaminated by model training data. If a model has already ingested a public vulnerable repository, it may appear to reason through the bug while actually recalling a known answer.To reduce that problem, Mandiant developed proprietary synthetic codebases spanning software domains, programming languages, vulnerability depths and architectures, from monoliths to microservices. Security consultants manually verify the injected vulnerabilities, and the grading process compares harness output with a ground-truth dataset using precise matches rather than loose semantic similarity.
The grading workflow also routes apparent false positives and duplicate findings through additional review before a human expert checks the AI judges. For security teams, this is one of the more transferable lessons in the post: evaluating an AI security pipeline requires controlled test cases, expert review and regression checks, not only impressive examples from live engagements.
Conclusion
AVDH is best read as a blueprint for structured defensive use of AI in source code review. Google and Mandiant are arguing that the advantage comes from orchestration: threat modeling first, entry-point discovery, context enrichment, separate hypothesis generation, skeptical validation, benchmarking and human sign-off.The approach also shows where enterprise AI security tooling is headed. Google says AVDH can be paired with CodeMender's ongoing scanning as a two-layer strategy, using AVDH for deeper point-in-time assessments and CodeMender for continuous monitoring and remediation. Defenders considering similar systems should focus less on the model name and more on the controls around it: rich environmental inputs, repeatable gates, benchmark discipline and accountable human review.
Sources
Editorial Team - CoinBotLab