Google is describing an agentic security workflow that does something more interesting than ask a model to “find bugs”: it breaks the work into scan, structural verification, human review and repair.

In a September 18 Google Cloud post, Google says it is using AI agents to scan code changes before submission across its infrastructure. The company says the workflow has prevented hundreds of vulnerabilities per month and brought false-positive rates down to 3% in some cases. Those are Google’s own operational claims, not independently verified results.

The more broadly useful lesson is architectural. AI-assisted code security becomes credible when an initial model finding is treated as a hypothesis that must survive deterministic checks and expert review. That is a much better product pattern than turning an agent loose on a repository and treating a fluent explanation as evidence.

The workflow Google describes

Google says its pre-submit scanner works on individual code changes rather than waiting for a large periodic scan. A localized threat model provides context about dependencies and likely attack paths. A specialist triage agent then checks whether the reported vulnerable path is actually reachable using code structure, call graphs and pre-indexed rules. Google says that stage reaches more than 92% precision in under a minute.

A nightly, post-submit layer searches for weaknesses created by interactions between changes. When a finding has enough support, a fix agent prepares a proposed patch for a human reviewer rather than applying a change invisibly. The company has also made its Mantis multi-agent review harness open source.

Why the validation stage is the headline

Generative models are excellent at proposing suspicious patterns, but a security team pays the cost of every false alarm. A finding that looks plausible in a code snippet can be unreachable, protected by authorization or already sanitized elsewhere in the application. Google’s approach is valuable because it inserts a separate proof-oriented step between model speculation and developer action.

That separation also makes the system easier to improve. Teams can measure scan recall, triage precision, review acceptance and fix quality separately. If those metrics are collapsed into “the agent found a bug,” an organization cannot tell whether more model capability, more context or a better rule is actually responsible for the result.

A practical starting point for smaller teams

Few teams have Google’s scale, but the sequence is portable. Start with one high-signal check in pull requests: for example, a new externally reachable endpoint, a change to authorization logic or a new path that handles secrets. Give the agent the narrow diff, a short threat model and an explicit list of assets it must not touch.

  1. Ask for candidates, not verdicts. Require the agent to name the entry point, data flow and claimed impact.
  2. Verify with tools. Use static analysis, tests, call-graph checks or a small reproduction to decide whether the path is real.
  3. Keep the approval gate human. Let an engineer own the decision to merge a security fix.
  4. Measure the handoff. Track which findings are confirmed, rejected or fixed, and why. Those labels become the useful feedback loop.

This is a genuinely exciting use of AI: not a replacement for security judgment, but a system that gives the people making that judgment more coverage and faster evidence. The harness and its gates do much of the work that makes the model’s output safe to use.

What to watch

Google’s published numbers are promising but company-reported. The next meaningful evidence would be reproducible results from Mantis or other teams, with benchmark definitions, false-negative measurement and repair-quality data. Until then, the right adoption target is a controlled review assistant with measurable gates—not fully autonomous patching.

Sources and update record

Last updated September 19, 2026. We will update this analysis if reproducible third-party results or material technical documentation is published.