Agentic Code Review Needs a Human Validation Gate

Source: Google Cloud / Mandiant — Staying Ahead of Adversarial AI Through Agentic Source Code Review

TL;DR

Google Threat Intelligence describes an Agentic Vulnerability Discovery Harness that chains specialized agents around a deterministic security workflow. The system builds a threat model, discovers entry points, enriches context, generates hypotheses, validates them, and hands confirmed findings to human experts for exploit reproduction. Netics’ position is direct: agentic code review is useful when it structures uncertainty and produces evidence; fluent findings are not vulnerability proof. The workflow starts with a threat model, separates hypothesis generation from validation, keeps human reproduction as the gate, and makes knowledge rules maintainable.

Orchestration is the security feature

Mandiant says the harness is built with Google Agent Development Kit and uses a sequential pipeline. Each stage has a job. Explorer agents establish the software domain and map the codebase. Specialist explorers examine areas such as authentication, authorization, and routing. A synthesis step turns those observations into a threat model before deeper analysis continues.

This structure matters because a general-purpose model can jump from a suspicious line to a confident conclusion without understanding reachability. A pipeline forces the system to establish what the application does, which components are exposed, and what assumptions must be tested.

Start with a threat model, not a grep result

The harness uses contextual inputs such as asset inventories, software bills of materials, architecture documentation, and threat intelligence. Discovery agents identify entry points and user inputs. Enrichment agents then follow permissions, sanitizers, routing conditions, nested calls, and storage boundaries.

That context changes the question from “does this pattern look dangerous?” to “can this input reach a dangerous sink under the application’s actual authorization model?” It also makes the analysis more auditable. A reviewer can inspect why a route was considered in scope, which identity was assumed, and what code path was followed.

Netics recommends making the threat model a visible approval artifact. If the model is wrong, the downstream findings may be precise answers to the wrong question.

Separate hypothesis generation from validation

Mandiant describes access-control and data-flow agents that generate vulnerability hypotheses. A confidence filter manages the volume. Validation agents then assess the hypotheses, and a synthesis agent classifies them as confirmed, disproven, or rejected.

This separation is more important than the model brand. Discovery can be broad and exploratory; validation must be skeptical and tied to the threat model. A system that only generates more findings optimizes output volume. A system that validates reachability, privilege boundaries, and data flow can improve the analyst’s signal.

Human exploit reproduction remains the gate

The source states that human experts reproduce exploitation and discard findings that fail dynamic testing or encounter compensating controls. That is the point at which a model-generated hypothesis becomes security evidence. It is also where organizations must define safe procedures, scope, credentials, and rollback.

Mandiant reports more than 100 true-positive critical vulnerabilities in two days in one incident-response investigation, analysis across tens of millions of lines of code, thousands of pipelines, and 12 assigned CVEs. Those figures are Mandiant’s reported results in its environments. They are not a transferable promise for every codebase or model.

Knowledge rules make the workflow maintainable

The harness uses distilled language, framework, and vulnerability rules to inject consultant expertise into the pipeline. This is stronger than a single oversized prompt because the knowledge is modular. Rules can apply broadly to a language or framework, while vulnerability-specific guidance can shape the final discovery and risk-rating stages.

Netics recommends versioning these rules, assigning owners, and measuring changes against synthetic codebases with human-verified ground truth. Benchmarks should track true positives, false positives, duplicates, missed vulnerabilities, and regression after prompt or rule changes.

FAQ

Can an agentic source-code review replace a security expert?

No. It can expand discovery and organize evidence, but human experts must validate reachability, exploitability, compensating controls, and disclosure decisions.

Why is threat modeling necessary?

Without a threat model, the system may analyze unreachable code, miss business logic, or misread which identities and assets are actually exposed.

What is the minimum safe deployment pattern?

Use a narrow scope, deterministic stages, versioned rules, synthetic benchmarks, human validation, complete logs, and a rollback path for any automated change.

Conclusion Netics

For teams planning an AI security review, generated findings still need a human validation boundary.

Agentic code review becomes credible when the orchestration is deterministic, the context is explicit, the hypotheses are challenged, and the final claim is backed by human-reproduced evidence.

Source: Google Cloud / Mandiant, Staying Ahead of Adversarial AI Through Agentic Source Code Review — https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review