Google says AI agents now scan every code change before it ships

Google has published an account of how it defends its own software, and the short version is that machines now check the machines. Two of its infrastructure engineering leaders wrote that AI agents scan every code change the company deploys, the moment a developer submits it.[1]

The scale claimed is large. Google says the agents run across hundreds of millions of lines of deployed code and stop hundreds of vulnerabilities a month from reaching production. The reason given is that AI now writes more code, faster, than the old checks can handle.[1]

The post is signed by Andres Lagar-Cavilla, a distinguished engineer at Google, and Parthasarathy Ranganathan, a vice president and engineering fellow. It describes AI-native agentic methods that embed vulnerability scanning and patching directly into the company's software development lifecycle, instead of bolting security on at the end.[1]

Google frames the problem plainly. Code generation is scaling, and so are the challenges of securing it, including what the company calls emerging AI-based vulnerability exploitations. This describes an internal practice, not a product launch. No price, date or customer is attached.[1]

Traditionally the industry runs large one-off security scans that are slow and short on context, so flaws surface too late. Google says it moved to pre-submit scanning instead, evaluating each check-in across every layer of the stack as it happens, inside the tools developers already use.[1]

The technical argument underneath is worth understanding. Scanning one small change needs far less context than scanning a whole repository. Less context, in Google's account, makes the scan more effective rather than less. A post-submit scan still runs overnight as a second layer.[1]

The accuracy claims rest on a two-step design. A lightweight scan produces candidates, then a triage agent checks the structure of the code, using syntax tree parsing, call-graph traversal and pre-indexed safety rules, to prove an attacker can reach the path. Google puts it above 92% precision.[1]

Accuracy also comes from context. Google says it evolved Mantis, its multi-agent review harness, to work against localised threat models built from live codebase metadata rather than static documents. It reports false positives falling to 3% in some cases, a qualified figure rather than a fleet-wide average.[1]

Finding a flaw is only half of it. Google says an automated bug-fix agent takes the scan result and the generated proof, writes a fix matching internal coding standards, and submits it for human review inside the same change request. The human stays in the loop by design.[1]

Mantis is now open source, and its documentation is franker than the blog post. It warns that AI models are non-deterministic and can hallucinate findings or generate incorrect patches, that a security expert must verify every finding, and that the suite should run only in isolated environments with no access to production systems.[2]