Industry story
Google Cloud Shares Agentic Vulnerability Discovery Harness Architecture
coding-agents orchestration security tool-use
Google Cloud's release of the Agentic Vulnerability Discovery Harness architecture is the right move, and the timing matters. Offense has been using AI to find exploits faster than defenders could manually track them; AVDH is Google's attempt to close that gap on the defensive side, pairing autonomous multi-step code review with continuous scanning tools like CodeMender. Wiz Research is already showing what this looks like in practice, using multi-agent pipelines to reverse-engineer actively exploited CVEs, including Metabase CVE-2026-72898. The question now is whether the architecture translates cleanly enough that security teams outside Google's ecosystem can actually operationalize it, or whether this stays a blueprint that only Google-adjacent shops can run.
Full analysis
Google Cloud's threat intelligence team is publicly releasing details of its Agentic Vulnerability Discovery Harness (AVDH) architecture, designed to help defenders implement agentic approaches (autonomous, multi-step AI) to source code security review. The AVDH can be paired with ongoing scanning tools like CodeMender to create a two-layered defense strategy for finding zero-day vulnerabilities at scale.
Separately, Wiz Research (a Google Cloud partner) is described as using multi-agent AI systems to discover high-impact zero-day vulnerabilities in cloud infrastructure, and has reverse-engineered at least one actively exploited CVE (Metabase CVE-2026-72898) using AI to accelerate defense. Together these disclosures signal a broader push by the Google Cloud security ecosystem to operationalize multi-agent pipelines for offensive security research and vulnerability management.
Comments