What happened
Google Threat Intelligence Group publicly detailed AVDH, an internal multi-agent (Google ADK-based) source-code vulnerability discovery pipeline used in Mandiant IR, pentests and red-team engagements for 10 months; it found 100+ true-positive critical vulns in two days on stolen-repo IR case and has produced 12 assigned CVEs, with mandatory human validation before any finding counts.
Why it matters
This is the most detailed public disclosure of a production, human-in-the-loop agentic vulnerability-discovery harness from a top-tier vendor, giving defenders a reference architecture (threat modeling → entry-point discovery → enrichment → hypothesis generation/validation → human review) to evaluate for their own AppSec/IR pipelines.
Applicability
AppSec, red teams, and IR teams evaluating agentic code-review tooling should study the architecture now; production use requires benchmarking and human reproduction before adoption.