A PM can summarize research, draft a PRD, and mock up a prototype before lunch. The hard part starts when the team has to decide what actually gets built.

Jira Product Discovery gives product teams one place to capture insights, prioritize ideas with consistent frameworks, and build living roadmaps stakeholders can rally around.

And because it’s connected to Jira, the context behind every decision stays with the work—so developers and their agents know not just what to build, but why.

AI helps PMs move faster. Jira Product Discovery helps the whole team build with confidence.

Get Started for Free

Google has described an internal security pipeline that checks infrastructure code during development instead of waiting for occasional large scans.

The Google AI and Infrastructure team published the technical account on September 18, 2026.

The system uses AI agents to scan code changes, validate potential findings, and construct proposed fixes.

Google says it scans every code change across hundreds of millions of lines deployed to its infrastructure.

The company says this process prevents hundreds of vulnerabilities per month from reaching its codebase or production systems.

Those figures are internal operational claims, not results from an independent public benchmark.

The pipeline begins with pre-submit scanning.

Each code check-in is evaluated across the software stack while developers are still working on the change.

Google argues that a small code change provides better context for an agent than a large one-off scan.

The system uses localized threat models instead of one static security document.

Google says those threat models use live codebase metadata and dependency call graphs.

The metadata gives the scanning system information about the codebase, packages, and libraries involved in a change.

The call graph helps the system examine whether a vulnerable path can connect to an attacker-controlled route.

Google says localized threat models reduced false-positive rates to 3% in some cases.

That result applies to the company’s reported internal cases and does not establish the same rate elsewhere.

The next wave of millionaires will be people who figured out how to make AI work for them.

The window to get ahead is still open. But not for long.

Here are 200+ proven ways to make money with AI in 2026.

Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.

Claim your free list

The first scan is followed by specialized triage.

Google says the triage agent uses abstract syntax trees, call-graph traversal, and pre-indexed safety rules.

The stated purpose is to test whether the reported path is structurally reachable.

Google reports more than 92% precision for this triage agent and a response time under one minute.

Precision is not the same as complete detection.

The system can still miss a weakness that its rules, context, or model do not represent.

Nightly integration testing provides a second layer.

That scan looks across multiple changes and may identify interactions that a single-change review cannot see.

The final component is a bug-fix agent.

It uses scan results and generated proof snippets to construct a proposed correction.

Google says the agent submits the fix for human review inside the original change request.

This keeps the generated patch within an engineering review process rather than treating the agent’s output as an automatic deployment.

The design reflects a wider change in the threat model for software systems.

Mandiant and Google Threat Intelligence Group report that attackers are using AI for reconnaissance, vulnerability research, and multi-stage operations.

Their 2026 risk report also describes supply-chain attacks involving AI components, agent skills, and coding assistants.

That context makes continuous code analysis relevant beyond one company’s infrastructure.

It also shows why security agents need access to the same structural facts that engineers use.

A generic language model can describe a possible flaw without proving that the code path exists.

Structural parsing and dependency analysis add a separate test of reachability.

The approach still has operational limits.

Threat models can become stale when dependencies, services, or deployment paths change.

AI-generated fixes can introduce new defects or alter behavior outside the reported path.

Nightly testing cannot replace review of urgent changes that arrive between scheduled scans.

The useful lesson is narrower than a claim that AI has solved code security.

Continuous scanning can shorten the distance between a change, a verified finding, a proposed correction, and human review.

Its value depends on current code context, deterministic checks, and an accountable engineering process around the model.

This guide distills 10 AI strategies from industry leaders that are transforming marketing.

Outpace your competitors by mastering AI.

Get Your Free Guide