AI-Assisted Vulnerability Management

What it is

A Mandiant Consulting blog by Jules Czarniak giving operational guardrails for deploying privileged LLM agents into codebases, dev environments and CI/CD pipelines for automated vulnerability discovery and remediation. The existing summary lists the framework references and controls; below are the specifics it omits — the driving metric, the provider constraints, and the layered/ordering details that change how you'd actually stand this up.

Why now

Per the cited M-Trends 2026 report, mean time-to-exploit (TTE) has dropped to -7 days — vulnerabilities are often exploited roughly a week before a patch exists. That negative window is the stated justification for automating discovery/remediation with agents at all.

What to do

Beyond the controls already in the catalog summary, the page specifies:

• Zero data retention (ZDR): enforce strict ZDR agreements with LLM providers so proprietary code and discovered vulnerabilities are never used to train external models.
• Clear the AUP hurdle first: many cloud/LLM providers block or throttle automated offensive security probing by default. Establish rules of engagement and authorized-testing agreements before pointing an agent at a target.
• Red-team the agent itself before deploying autonomous scanners that spin up sandboxes and execute code — validate resilience against jailbreaks, recursive logic loops and prompt injection so the security tooling doesn't become the attack vector.
• Two-layer defense, in order: Layer 1 = deterministic policy engines as chokepoints; Layer 2 = reasoning-based guard models (Model Armor or provider-agnostic equivalents). Enforce data security before the prompt reaches the model.
• Non-production + synthetic data for all testing; agents should not reach PII/PHI at all.
• JIT tokens scoped to the exact repo and branch under review, tied to a distinct machine identity that maps back to a human controller for accountability/consent — so a compromised container cannot pivot to adjacent codebases.

How the trust boundaries stack

flowchart LR
  A[Untrusted input:\ncode, comments, deps, MCP] --> B[Layer 1\ndeterministic policy]
  B --> C[Layer 2\nguard model]
  C -->|clean| D[Agent in\nunprivileged sandbox]
  C -->|injection/PII| X[Blocked]
  D -->|JIT token,\nrepo+branch scoped| E[PR / commit]
  D -.runtime.-> F[Toxic flow analysis\nmonitors exfil paths]

Caveats

This is architectural guidance from a consulting practice, not a tool or reproducible procedure — no code, versions, or benchmarks. The fetched text is truncated mid-sentence in the Toxic Flow Analysis section, so the TFA detail is incomplete. The named frameworks (SAIF, NIST AI RMF, OWASP Top 10 for LLMs) are referenced, not reproduced; you'd still need to consult them to operationalize.