Google Cloud BlogAndrés Lagar-Cavilla4 min readintermediate
Changing the game: How Google uses agentic AI to secure hundreds of millions of lines of code
Summary
Google’s AI & Infrastructure team built an agentic pipeline (Mantis) that runs pre‑submit AI‑driven scans on every code check‑in, validates findings with a fast triage agent (AST + call‑graph analysis) achieving >92% precision in <1 min, then auto‑generates fixes via a bug‑fix agent. Localized threat models and a two‑step scan cut false‑positives to ~3% and prevent hundreds of vulnerabilities eac…
- Pre‑submit AI scanning replaces slow, one‑off scans; it runs on each check‑in with low latency.
- Mantis harness ties AI agents to live, package‑level threat models and call‑graph metadata, boosting precision.
- A lightweight triage agent validates AI findings using deterministic AST and domain rules, achieving >92% precision in under a minute.
- An automated bug‑fix agent creates code fixes that are submitted for human review, closing the detection‑to‑remediation loop.
Embedding AI‑driven, continuous security checks into the SDLC catches bugs before they ship, dramatically reducing exposure risk at scale (hundreds of millions of LOC) while keeping developer velocity high.
6/10
