Google-owned cybersecurity firm Wiz announced the launch of Atlas, an AI agent-based vulnerability discovery system capable of autonomously finding vulnerabilities. Atlas has so far discovered more than 200 security vulnerabilities and also won a $100,000 bounty from GitHub for vulnerability discovery (Note: approximately 678,000 yuan at the current exchange rate).
According to the company, Atlas consists of multiple AI agents, each responsible for different tasks, and operates much like a human security research team. Different agents are responsible for understanding the codebase, proposing vulnerability hypotheses, verifying and challenging one another, and ultimately confirming and reporting vulnerabilities.
Unlike a traditional single AI model that executes a task from start to finish, Atlas discovers vulnerabilities through multi-stage task decomposition and programmatic collaboration. It first builds a threat model for the target software codebase and uses a Code Property Graph to analyze the program structure and identify potential attack paths.
Next, multiple AI agents in the system independently propose and verify vulnerability hypotheses, generate candidate multi-step compound vulnerabilities, and submit them to three agents serving the roles of “supporting argument,” “counterargument analysis,” and “final adjudication.” Only vulnerabilities that pass verification are retained.
Finally, Atlas automatically creates a dedicated testing environment, installs the required dependencies, and executes attack inputs to trigger the vulnerabilities, thereby verifying whether they actually exist.
To reduce operating costs, Atlas uses a more refined AI task allocation strategy. For example, the system calls more capable large models only for tasks requiring strong reasoning abilities, such as analyzing complex vulnerability exploit chains and making final vulnerability decisions. Tasks with clearly defined scopes and high repetitiveness, such as Code Property Graph analysis and preliminary vulnerability screening, are handled by lower-cost small models.
In addition, Atlas combines deterministic code analysis techniques for efficient guidance, uses an adversarial review mechanism to filter out false positives in advance, and employs a harness designed specifically for vulnerability research to perform verification, further reducing operating costs.
Wiz said this design enables Atlas to conduct large-scale, in-depth code analysis at a relatively low cost. The system also automatically generates exploit validation programs for each discovered vulnerability, reducing the possibility of false positives. According to the CyberGym AI vulnerability research benchmark results cited by Wiz, Atlas achieved a score of 90.9%, surpassing competing models including GPT-5.5-Cyber, Claude 4.6, and Claude Mythos Preview.
In terms of real-world applications, Wiz said that after several months of development, Atlas has discovered and verified more than 200 previously unknown vulnerabilities in multiple well-known open-source projects. It also helped GitHub discover a major remote code execution vulnerability, CVE-2026-3854, earning a $100,000 bounty (approximately 678,000 yuan at the current exchange rate).