Loading story…
Google-owned Mandiant disclosed an internal AI-assisted vulnerability discovery platform, the Agentic Vulnerability Discovery Harness (AVDH), saying it identified more than 100 verified high-severity software flaws in two days during a live investigation tied to stolen corporate repositories. Mandiant said the system has been used internally for about ten months, scanned tens of millions of lines of code, and produced tens of thousands of findings, including dozens of assignable vulnerabilities affecting widely used web extensions and open-source projects.
Mandiant said the work has already led to 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803, with roughly another dozen cases still in coordinated disclosure. The company described AVDH as a pipeline of specialized AI agents handling threat modeling, entry-point discovery, context enrichment, hypothesis generation, and validation, while stressing that human analysts still review threat models and manually reproduce exploits before findings are accepted. To reduce false positives, agents are designed to challenge one another’s conclusions and apply consultant-authored rules by language, framework, and vulnerability type; Mandiant also said it evaluated the system on synthetic intentionally vulnerable codebases rather than public benchmarks to avoid model-training contamination.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Google published a Threat Intelligence blog post describing Mandiant's internal AVDH system, its multi-agent workflow, and its use in agentic source-code review. The disclosure emphasized human validation and techniques intended to reduce false positives.
Mandiant said findings from AVDH have already resulted in 12 assigned CVEs, including CVE-2026-13242 and CVE-2026-55803. It also said about a dozen additional vulnerabilities are under active disclosure.
During a live investigation involving stolen corporate repositories, Mandiant said AVDH identified more than 100 verified high-severity vulnerabilities in just two days. The company presented this as a real-world demonstration of the system's effectiveness.
Mandiant said its Agentic Vulnerability Discovery Harness (AVDH), an AI-assisted source-code vulnerability discovery system, has been running internally for ten months. During that period it scanned tens of millions of lines of code and generated tens of thousands of findings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-assisted vulnerability research is contributing to a sharp rise in disclosed high- and critical-severity software flaws, with monthly totals reportedly climbing from fewer than 100 to more than 600. Anthropic's Project Glasswing reportedly identified over 10,000 high- or critical-severity issues, while exploitation of disclosed vulnerabilities is increasingly occurring on the day of disclosure or earlier, making patch cycles measured in weeks inadequate. Okta used pre-release OpenAI and Anthropic frontier models through the Daybreak Cyber Partner Program and Project Glasswing to scan high-priority customer-installed software across hundreds of repositories. Its testing found that autonomous agents frequently generated false positives or overstated severity, while expert-led investigation, manual reproduction, and triage substantially improved results. VMware similarly prioritized fixes found after adopting Claude Mythos and Project Glasswing, releasing VCF 9.1.1 as a security-focused update and delaying planned VCF 9.2 features.
Sep 9, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
Google’s Threat Intelligence Group said it detected and disrupted what it described as the first observed zero-day exploit likely developed with artificial intelligence assistance, targeting a widely used open-source web administration platform. The flaw reportedly involved a semantic logic weakness in the platform’s two-factor authentication flow, and Google said the exploit appeared intended for mass exploitation before the vendor was notified and issued a patch. Researchers cited indicators of LLM involvement in the exploit code, including unusually didactic docstrings, textbook-style formatting, and even a hallucinated CVSS score, while noting they had high confidence an AI model helped both identify the vulnerability and weaponize it. The incident comes amid broader evidence that AI is becoming embedded across the attack lifecycle. Google and other researchers reported threat actors using large language models for reconnaissance, phishing preparation, troubleshooting, malware development, and increasingly autonomous attack orchestration, including malware able to assess victim environments and execute commands with less human oversight. Check Point Research separately described the **VoidLink** Linux malware framework as an example of AI-assisted malware development at operational scale, with a single developer allegedly producing more than 88,000 lines of code in under a week using an AI-powered IDE, while other reporting linked China-, North Korea-, and Russia-aligned activity to AI-enabled exploit research, decoy code, voice cloning, and Android malware automation.
Jun 29, 2026