Mandiant shares Agentic Vulnerability Discovery Harness for AI-powered code review
Google Cloud's Mandiant security team is sharing details of its internal Agentic Vulnerability Discovery Harness (AVDH), an architecture for AI-powered source code review. AVDH combines multi-agent orchestration with human expertise to rapidly identify and validate security vulnerabilities, enabling defenders to counter adversarial AI. In 10 months, it has significantly accelerated vulnerability discovery, finding over 100 critical flaws in two days during one incident and contributing to 12 assigned CVEs. The methodology, which uses Google ADK and aligns with Antigravity, can be adapted by other security teams for proactive reviews and incident response.
- →Introducing the Agentic Vulnerability Discovery Harness (AVDH)
- →Demonstrated impact in real-world vulnerability discovery
- →AVDH architecture uses Google ADK for agent orchestration
- →AI-driven threat modeling enhances code analysis
- →Automated entry point and context enrichment
Notes (6) ›
- Introducing the Agentic Vulnerability Discovery Harness (AVDH)
Mandiant shares details of AVDH, an internal architecture combining AI models with human expertise to rapidly analyze source code and find exploit paths, helping defenders against adversarial AI. It uses multi-agent orchestration to augment vulnerability discovery and validation.
- Demonstrated impact in real-world vulnerability discovery
In 10 months, AVDH has rapidly discovered over 100 critical vulnerabilities in two days during an incident response, analyzed millions of lines of code, and led to 12 assigned CVEs, significantly accelerating Mandiant's vulnerability detection.
- AVDH architecture uses Google ADK for agent orchestration
The AVDH pipeline orchestrates specialized agents deterministically using Google Agent Development Kit (ADK), aligning with Google Antigravity. This framework structures vulnerability discovery around proven methodologies, chaining agents sequentially.
- AI-driven threat modeling enhances code analysis
AVDH's initial step involves an Explorer agent identifying the codebase's purpose and architecture to establish a threat model. This uses LLMs to distinguish code access and is verified by human experts before proceeding, providing crucial context.
- Automated entry point and context enrichment
Following threat modeling, Discovery agents using Gemini Flash Lite identify critical application entry points and user input sources. Enrichment agents then aggregate contextually relevant code, navigating distributed components to prepare for deep analysis.
- Generating hypotheses for control and data flow analysis
AVDH delegates the analysis of control and data flow to specialized Access Control and Data Flow Analysis agents. These agents initially focus on expansive brainstorming, performing minimal self-validation at this stage.
https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review/
Related releases
- Bringing gVisor Sandboxes to Distributed Ray Clusters on Google Cloud Google Cloud Blog ·
- Introducing Gemini Enterprise for Financial Services Google Cloud Blog ·
- Google Cloud Introduces Gemini Enterprise for Legal AI Solution Google Cloud Blog ·
- Anthos Config Management gets security updates and monitoring controls Google Cloud release notes ·
- Google SecOps SIEM Adds Unroll Processor for Data Processing Pipelines Google Cloud release notes ·
- Container Optimized OS Updates Address Linux Kernel Vulnerabilities and Package Upgrades Google Cloud release notes ·