エージェント型ソースコードレビューで敵対的AIの脅威に先手を打つStaying Ahead of Adversarial AI Through Agentic Source Code Review

Google's Mandiant team has published details of an agentic approach to source code review that aims to help defenders find and fix software vulnerabilities before attackers can exploit them. The work matters because the same generative and agentic AI tools that accelerate legitimate engineering are increasingly being turned against organizations, raising the stakes when proprietary source code is stolen or leaked.

According to authors Alex Tselevich and Michael Maturi, adversarial misuse of AI has heightened the risk of data theft and extortion events. When proprietary source code is exposed, defenders must scramble to identify and patch vulnerabilities, often while attackers deploy machine-speed AI tools against the same code. That asymmetry is the core problem the framework is designed to address: closing the window between a breach and a working exploit.

At the center of the effort is what Mandiant calls the Agentic Vulnerability Discovery Harness, or AVDH. The team describes using AVDH to rapidly analyze code and surface exploit paths during proactive reviews and penetration testing engagements. Rather than treating a large language model as a standalone oracle, the approach wraps AI models in what the authors describe as a deeply structured, human expert-driven orchestration layer. The stated goal is to tip the scales so defenders can, in their words, beat adversaries to the punch.

The technical emphasis is less on the raw capability of any single model and more on how the analysis process is organized. The team highlights three levers that it credits for a leap in efficacy: structuring the analysis process, enforcing skeptical validation steps, and injecting domain-specific human expertise directly into the pipeline. The skeptical validation element is notable, because a recurring weakness of AI-assisted security tooling is the tendency to produce plausible but incorrect findings, sometimes called hallucinations or false positives. Building explicit verification into the workflow appears intended to filter out spurious results before they reach a human reviewer, which is often the most expensive part of a security assessment.

This orchestration-heavy design reflects a broader pattern in agentic AI, where systems are given the ability to plan, call tools, and iterate across multiple steps rather than answering a single prompt. In a vulnerability discovery context, that can mean tracing data flows, reasoning about how untrusted input reaches sensitive functions, and chaining observations into a candidate exploit path. Keeping human experts in the loop is a way to supply the contextual judgment that models still tend to lack, such as understanding an application's threat model or distinguishing an exploitable bug from a benign one.

The framework sits alongside a long history of automated code analysis. Traditional static application security testing tools and fuzzing systems, including Google's own OSS-Fuzz for open-source projects, have found large numbers of bugs for years, but they can generate noise and struggle with complex, multi-step logic flaws. More recently, the industry has experimented with LLM-driven vulnerability research, and Google has publicly discussed related efforts such as its Big Sleep project. Government-backed initiatives like DARPA's AI Cyber Challenge have similarly pushed automated systems to find and patch vulnerabilities at scale. Mandiant's contribution is framed less as a new model and more as a methodology for orchestrating existing models with human oversight.

Context around Mandiant itself is relevant. The company is a well-known threat intelligence and incident response firm that Google acquired and folded into Google Cloud, and its work is often informed by real-world investigations into breaches and extortion campaigns. That background likely shapes the framing here, which treats leaked source code as a live operational threat rather than a hypothetical one.

The published details describe a defensive workflow used in proactive reviews and penetration tests, and the authors present the efficacy gains as their own results rather than independently benchmarked figures. As with any agentic security tooling, the practical value will depend on how well the skeptical validation and human review steps scale, and how the approach performs against varied codebases. Still, the emphasis on disciplined orchestration and expert judgment reflects a pragmatic view that, for now, the most effective defensive AI systems are likely to be hybrids of automation and human expertise.