Mandiant Details AI-Assisted Harness for Finding Source-Code Vulnerabilities
Summary
Mandiant describes AVDH, a multi-agent harness for source-code vulnerability discovery that combines threat modeling, code analysis, validation, and human review. The company says it found more than 100 critical vulnerabilities in two days during an incident response.
Key points
- AVDH sequences specialized agents to model a codebase, identify entry points, enrich code context, and generate vulnerability hypotheses.
- Access-control and data-flow agents examine issues such as missing authorization, SQL injection, cross-site scripting, and command injection.
- Separate validation agents assess hypotheses; consultants then reproduce exploitation and discard findings that fail human validation.
- Mandiant says AVDH identified more than 100 true-positive critical vulnerabilities in two days while analyzing stolen corporate repositories.
- The harness has analyzed tens of millions of lines of code and contributed to 12 assigned CVEs, according to the article.
- Mandiant evaluates the pipeline against manually verified synthetic vulnerable codebases, with AI grading and expert review.
Article Details
- Topic
- Agentic AI-driven source-code vulnerability discovery and validation
CVE
CVE-2026-13242in widely used web extensions and open-source projects, resulting in 12 assigned CVEs, including CVE-2026-13242, CVE-2026-55803, and an additional dozen currently in active disclosure.CVE-2026-55803web extensions and open-source projects, resulting in 12 assigned CVEs, including CVE-2026-13242, CVE-2026-55803, and an additional dozen currently in active disclosure.
People
Vendors
GoogleFor AVDH, we used the Google Agent Development Kit (ADK), an LLM framework that implements the most common agent orchestration patterns, and provides flexibility for configuring custom and third-party integrations.MandiantThis has greatly accelerated how Mandiant discovers vulnerabilities at scale.
Products
CodeMenderAVDH can also be used alongside CodeMender’s ongoing scanning to create a two-layered defense strategy.Gemini Flash LiteThese agents use the lightweight Gemini Flash Lite model to process code at scale to extract critical application entry points, such as HTTP routes, inter-process communication (IPC) listeners, and other domain-specificGoogle Agent Development KitFor AVDH, we used the Google Agent Development Kit (ADK), an LLM framework that implements the most common agent orchestration patterns, and provides flexibility for configuring custom and third-party integrations.Google AI Threat DefenseFor organizations looking to deploy these capabilities out-of-the-box, Google AI Threat Defense offers an always-on platform.Google AntigravityThis approach aligns with the agentic orchestration capabilities now available in Google Antigravity, which provides a centralized workspace for builders to steer and manage these agentic workflows.