Google Uses Agentic AI to Scan Hundreds of Millions of Lines of Code in Real Time

The Google AI & Infrastructure team has unveiled a new security methodology leveraging agentic AI. This system introduces pervasive pre-submit agentic scanning, which scans every code change (check-in) across hundreds of millions of lines of code in real time. Unlike traditional one-off large-scale scans, it is integrated into development tools, transforming security procedures into a continuous, routine process.

Technical Implementation and Performance

The system evolved Mantis, an open-source multi-agent review harness, to enhance the precision of security agents. It applied localized threat models that utilize live codebase metadata and dependence call graphs instead of static documentation to refine context. As a result, the false-positive rate decreased to 3% in some cases.

Agent Roles and Processing Workflow

• Triage agent: Performs two-stage verification to minimize latency. Stage 1 verifies the reachability of attack paths through AST parsing and call graph traversal, achieving over 92% precision and processing times of under 1 minute. Stage 2 detects vulnerabilities caused by multiple changes during overnight integration tests.
• Bug fix agent: Automatically generates precise fixes compliant with internal coding standards based on scan results and generated proofs (vulnerability execution code snippets). These are submitted alongside human review to reduce the time from detection to resolution.

Core Principles and Infrastructure

Google separated the harnesses, rules, and contexts of the development, scanning, and triage agents to prevent bias, while improving performance by combining lightweight AI scans with deterministic structural verification. This pipeline leverages Google Cloud, the Gemini Enterprise Agent Platform, and Gemini models based on Trillium/Ironwood TPU. The Mantis harness has been released as open source and is offered to customers as part of Google Cloud's secure software development lifecycle (SDLC) efforts.