Google has described how its security teams are using AI agents to find, track and fix software vulnerabilities, arguing that the economics of both attack and defence have changed as automated systems compress exploitation timelines.
The company’s account focuses on a connected operating model rather than a single scanner. Agents help identify flaws, preserve context as a finding moves between teams, rank work and support fixes. Google says the approach is designed to reduce response latency while retaining human direction for consequential decisions.
That distinction matters. Faster discovery does not automatically produce safer systems if remediation queues, ownership records or deployment controls cannot keep pace. Agentic security also creates a second assurance problem: defenders need evidence that a proposed fix addresses the vulnerability without introducing a new fault or crossing an architectural boundary.
Google’s post is an internal practice account and its claims have not been independently benchmarked in the source. The practical question is therefore not whether agents can generate fixes, but how organisations validate those fixes, preserve accountability and decide when automation should stop for review.
