3% false positives is not an AI scanner win. The threat model is doing the precision work.

Google said on 18 September that its agentic security pipeline now scans every code change across hundreds of millions of lines and prevents hundreds of vulnerabilities per month from reaching its code base or production. In some cases, localised threat models have pushed false-positive rates down to 3%.

The tempting conclusion is that the model became a better vulnerability scanner. Google's architecture points elsewhere: precision comes from constraining the agent with live code context, then checking its claims with a separate structural system.

Threat context belongs next to the code

Google evolved its open-source Mantis multi-agent review harness around localised threat models rather than static security documents. Those models consume live codebase metadata, while dependency call graphs expand the context across packages and libraries.

That changes the security control. A generic scanner asks whether a pattern resembles a vulnerability. A context-bound agent can reason about the component's actual trust assumptions and dependencies. Keeping the threat model current becomes part of maintaining the scanner, not an annual documentation exercise.

The useful security agent is not the one that knows the most code. It is the one whose context is narrow enough to be checked.

Use deterministic triage to challenge model findings

Google does not send every model finding directly to a developer. A specialised triage agent programmatically inspects code structure using abstract syntax tree parsing, call-graph traversal and pre-indexed safety rules to establish whether an attacker can reach the vulnerable path. Google reports more than 92% precision for this stage, with completion in under a minute.

The separation matters because generation and validation have different failure modes. The scanning agent can search broadly; the triage layer has to prove a narrower structural claim. Google also keeps a nightly post-submit scan as a second layer for vulnerabilities that emerge across multiple changes.

Make agent disagreement part of the release gate

For teams deploying AI-assisted code security, the production pattern is more useful than the particular models. Keep development, scanning and triage agents on separate harnesses and context. Feed the scanner versioned threat models and dependency information. Require structural evidence before an AI finding blocks a change or triggers remediation.

Google's bug-fix agent then uses scan results and generated proofs to propose patches for human review. That closes the loop without making model output self-authorising.

The operational metric should therefore extend beyond vulnerabilities found. Track false-positive rate by component, triage precision, validation latency, threat-model freshness and the share of proposed fixes accepted after review. If precision degrades, investigate the context and validation boundary before swapping the underlying model.

Written by the Devence Lab research team.