Overview of Agentic Source Code Review
Adversarial misuse of artificial intelligence has increased the risk of data theft and extortion events. When proprietary source code is exposed, defenders must scramble to identify and patch vulnerabilities while attackers deploy machine-speed tools against them. To counter this asymmetry, security teams are adopting structured architectures that combine machine learning models with human expertise. According to Google Cloud Threat Intelligence, combining AI models with a deeply structured, human expert-driven orchestration layer helps tip the scales so defenders can beat adversaries to the punch.
The Agentic Vulnerability Discovery Harness (AVDH) has been deployed to rapidly analyze code and find exploit paths during proactive reviews, penetration tests, red team operations, and incident response engagements. By combining multi-agent orchestration with frontline subject-matter expertise, this framework helps augment the discovery and validation of routine vulnerabilities, enabling human analysts to focus their impact.
Real-World Results and Impact
Over a ten-month operational period, the harness demonstrated significant impact during high-pressure engagements. During a recent incident response investigation involving stolen corporate repositories, the system discovered over 100 true-positive critical vulnerabilities in just two days. This automated approach achieved results in a fraction of the time required for traditional manual review, accelerating how Mandiant discovers vulnerabilities at scale.
The framework has analyzed environments spanning tens of millions of lines of code, executing thousands of pipelines to generate tens of thousands of findings. This rapid analysis uncovered dozens of assignable flaws in widely used web extensions and open-source projects, resulting in 12 assigned CVEs—including CVE-2026-13242 and CVE-2026-55803—alongside an additional dozen currently in active disclosure. Beyond broad scanning, the framework also acts as a force multiplier during targeted adversary simulation engagements, quickly identifying remote code execution pathways.
Architecting the Pipeline
Harnesses have become vital tools for cybersecurity applications of large language models, mitigating model unpredictability and non-deterministic behavior. The programmatic infrastructure of a harness orchestrates agents in a strictly deterministic manner toward objective completion.
The Sequential Discovery Workflow
AVDH chains specialized agents together in a sequential pipeline, where each phase is completed before the next begins. The architecture relies on several key components:
- Contextual Inputs: Rich environmental inputs such as asset inventories, software bills of materials, architecture documentation, and threat intelligence feed a distilled human knowledge base.
- Threat Modeling Stage: An Explorer agent identifies the core purpose of the target codebase, determining the software domain and dispatching specialist subagents to analyze authentication, authorization, and routing.
- Human Approval Gate: Analysts are presented with textual and visual representations of the threat model for verification before deep analysis continues.
Actionable Recommendations for Defenders
Security teams seeking to implement similar agentic approaches should prioritize structured integration patterns:
- Establish Clear Threat Models: Ensure automated code analysis tools incorporate environmental context, business logic, and reachability rather than relying solely on rigid pattern-matching rules.
- Combine Automation with Expert Review: Use multi-agent orchestration to generate prioritized, risk-rated lists of findings, but maintain human oversight to validate complex exploit chains and filter false positives.
- Integrate Continuous Scanning: Pair automated discovery harnesses with ongoing scanning tools to create a resilient, two-layered defense strategy capable of matching adversary velocity.
Related: AI-Powered Vulnerability Discovery: Automated Zero-Day Mining with LLMs, Cisco Catalyst SD-WAN CVE-2026-20245 Root Access Exploit Analysis