{
  "id": 2022984,
  "title": "Google AI agents expose over 100 critical code flaws",
  "url": "https://urgent.news/2026/08/19/google-ai-agents-expose-over-100-critical-code-flaws",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-19T21:15:53.000Z",
  "source": {
    "name": "Arabian Post",
    "slug": "arabian-post",
    "url": "https://thearabianpost.com/google-ai-agents-expose-over-100-critical-code-flaws/"
  },
  "original_language": "en",
  "account": "Mandiant's artificial intelligence (AI) system, known as the Agentic Vulnerability Discovery Harness (AVDH), has uncovered more than 100 critical vulnerabilities in stolen corporate source-code repositories within just two days. The AI-driven solution combines multiple specialized AI agents with structured orchestration and human security expertise to accelerate security investigations and software auditing.\n\nThe AVDH has been utilized for approximately ten months, encompassing incident-response investigations, penetration tests, red-team exercises, and proactive source-code reviews. The findings, classified as true positives, were discovered during an investigation into corporate repositories stolen by attackers. The results were not mere automated scanner alerts but genuine vulnerabilities confirmed by human specialists.\n\nThe AVDH is employed to examine software environments containing tens of millions of lines of code. Thousands of analysis pipelines have generated tens of thousands of potential findings, with several dozen flaws officially assigned CVE identifiers (Common Vulnerabilities and Exposures). Notably, CVE-2026-13242 and CVE-2026-55803 have been assigned, along with roughly a dozen more vulnerabilities undergoing coordinated disclosure processes.\n\nThe AI agents work collaboratively, with each focusing on specific areas. For instance, one agent examines the codebase's purpose and structure, identifies excluded directories, and studies available documentation. Other agents concentrate on authentication, authorization, and routing. Their findings are consolidated into a threat model requiring human review before automated investigation proceeds.\n\nOther agents analyze files for potential entry points, including HTTP routes and inter-process communication listeners. Additional agents gather surrounding context to determine whether apparent weaknesses are genuinely exploitable, considering permission checks, sanitization functions, routing conditions, and nested function calls. The approach addresses a longstanding limitation of conventional static-analysis tools, which often fail to understand whether vulnerable code can be reached by an attacker.\n\nThe system separately evaluates control flow and data flow. Control-flow analysis identifies weaknesses like missing authorization checks and privilege escalation opportunities. Data-flow agents trace untrusted input through an application to determine if it can reach sensitive operations, such as SQL injection, cross-site scripting, command injection, or path traversal. Verified findings are deduplicated and assigned risk levels, with security specialists attempting to reproduce the weakness and validate proof-of-concept exploits before considering the automated hypothesis actionable.\n\nAVDH has also demonstrated value in offensive-security simulations, uncovering remote-code-execution vulnerabilities during customer engagements, revealing how the technology can aid red teams in locating weaknesses that attackers might exploit. This development underscores a broader shift towards multi-agent security systems, emphasizing the importance of the surrounding agent harness, including roles, tools, communication, and verification procedures, in influencing vulnerability-discovery performance even when the underlying language model remains unchanged.",
  "summary": "Google’s Mandiant cybersecurity unit has disclosed that an artificial intelligence system uncovered more than 100 genuine critical vulnerabilities in stolen corporate source-code repositories within two days, demonstrating how agent-based AI could sharply accelerate security investigations and software auditing. The Agentic Vulnerability Discovery Harness, or AVDH, combines multiple specialised…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}