Google’s presubmit security agents: finding, structural triage and a human-reviewed patch

First-party account, not an audit: Andrés Lagar-Cavilla, Stella Voutsina and Parthasarathy Ranganathan, “Changing the game: Using agentic AI to secure infrastructure code,” September 19, 2026. The team says it scans code changes in its infrastructure code before submission with agents supplied localized threat models built from live code metadata and call graphs. Its open-source Mantis is a harness reference, not a reproducible record of Google's private runs. A second, lightweight triage agent checks reachability with AST parsing, call graphs and indexed safety rules; a nightly post-submit integration scan seeks multi-change vulnerabilities. A fixing agent writes a candidate patch against the detected finding and evidence, but submits it for human review in the original change request. The three roles—code author, security scanner/triager, repair proposer—do not amount to automatic release authority.

Metrics and uncertainty. Google claims hundreds of vulnerabilities a month prevented from entering its infrastructure code or production, false positives down to 3% in some cases, and >92% precision with triage under one minute. These are not a common fixed cohort, externally verified true-positive rate or customer-vulnerability denominator: no candidate count, tested baseline, blind independent replay, reviewer minutes, patch deployment rate, or subsequent exploit and regression outcomes is given. The article is an advocacy-oriented engineering account with named operators and an implementation argument, not a measured full cost of security engineering. Separate UK government’s June pilot reports human validation and patch responsibility but a different scanner mix and no compatible population. Do not combine counts.

Release implication. Scanner finding → code-structure triage → model-generated proposed repair → original PR human review → post-submit integration scan is a more explicit information path than a detached review dashboard. It does not show a release owner acknowledging an unresolved finding or an independent behavior oracle on deployed infrastructure. GitHub environment review documentation confirms a configurable, separate approve/reject deployment gate and possible bypass, but does not establish that Google uses it. For the distinction between a comment marked resolved and an owner carrying a warning to release, see warning→release brief. Synthesis.

Backlog: a relatively short weekday engineering argument if reviewer-disposition interest resumes and feed is not full. Not a substitute for released-change or repair evidence.