Google Cloud Deploys Multi-Agent System for Autonomous SDLC Security

Full analysis

Google Cloud has detailed how it uses interconnected AI agents (software programs that can reason and act autonomously) embedded across every stage of its software development lifecycle (SDLC) to automatically detect, validate, and patch security vulnerabilities at machine speed. The system spans design review, code scanning, fuzz testing (automated stress-testing of software), and post-launch posture management — replacing what were previously manual, human-dependent security checklists.

Central to the architecture is Mantis, Google Cloud's internal multi-agent orchestration framework for scalable code analysis. Mantis uses a hierarchy of specialized agents — Strategist, Research, Deduplicator, Reviewer, Critic, and a Reproduction Sandbox — to reduce token overhead by over 85% compared to brute-force code ingestion while cutting false-positive rates that plague simpler AI scanning approaches (which the post notes can have true-positive rates under 7%). Google has open-sourced the core skills of Mantis, while running a more capable internal version. The framework also incorporates a self-reflection loop where a dedicated agent analyzes past execution logs to build a compounding knowledge store injected into future agents' context.