Google Cloud issues guardrails for AI vulnerability agents

Google Cloud has published guidance from Mandiant Consulting on using AI agents in vulnerability management.

The document outlines a framework for security teams that want to deploy large language model agents in code repositories, development environments and software delivery pipelines without giving them unchecked access to sensitive systems or data.

It argues that growing interest in automated vulnerability discovery and remediation reflects a wider problem: attackers are exploiting software flaws faster than many organisations can patch them. Google cited Mandiant research showing that mean time-to-exploit has fallen to minus seven days, indicating that some vulnerabilities are abused before a patch is available.

The guidance urges companies to apply established risk frameworks to AI security work and extend existing deterministic controls to any environment where an AI agent operates. It also recommends treating source code as untrusted input, warning that prompt injection could be hidden in comments or third-party dependencies.