Google shares pre-commit AI security checks: fixes still undergo human review
Google shares how to incorporate AI scanning, triage and patch suggestions into infrastructure code development, emphasising checks on each code change and relevant threat models. The vendor says its patching agent proposes changes for human review, rather than replacing security review directly.
Source Facts
On 19 September, Google described an agent-based security workflow for infrastructure code, placing scans before commits and examining each change with its relevant dependencies. It says the workflow uses the Mantis multi-agent framework and threat models closely aligned with the code being examined.
The process also includes triage agents dedicated to checking findings, additional post-commit checks and agents that propose fixes. Google says proposed fixes still receive human review, and recommends separating the rules and context for development, scanning and triage to reduce interference between them.
Organisations doing development work can pilot limited checks on a non-critical project, measuring false positives and handling time. Retain code review and testing rather than automatically accepting fixes.
Original sources
Changing the game: Using agentic AI to secure infrastructure code
Sources checked: 2026-10-25 · Compiled with SI agent assistance; not individually reviewed by a human.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
IllustrationSOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process
Illustration