Over the past several months, the Wiz Research team has built and tested Atlas, an autonomous AI system for vulnerability research, against some of the world's most heavily audited open-source projects. Today Atlas ranks #1 on CyberGym - the public benchmark for AI-driven vulnerability work - with a 90.9% success rate, and in our own testing it has uncovered more than 200 previously unknown vulnerabilities in widely used open-source code that has been fuzzed and reviewed for decades.
Atlas was built as part of a broader effort to understand how frontier models can be used to deliver AI SAST at scale and make advanced code scanning accessible to every organization. That meant moving beyond expensive, point-in-time analysis to a continuous system that can run economically across every codebase and produce validated findings security and development teams can trust and act on. This is why we optimized Atlas for both cost efficiency and precision: deep analysis must be economical enough to run at scale, and every reported finding is validated with a working exploit generated by the system, keeping false positives low.
Along the way, we learned that the durable advantage is not any single model, but the system around it: how scans are scoped, orchestrated, validated, and turned into actionable security outcomes. This post is a technical look at how Atlas works, what building it taught us about scalable AI-driven code security, one of the vulnerabilities it uncovered, and how it fits into the broader agentic security system we are building at Wiz.
It’s also worth noting that one of reasons Wiz joined Google was the ability to collaborate on cutting edge AI models for cyber defenders. Since becoming part of Google Cloud, we took full advantage of this by working with the team at DeepMind to get input on Atlas.
The Results: 200+ Validated Vulnerabilities in Heavily Audited Open-Source Software
To evaluate Atlas, we pointed it at some of the world's most reviewed open-source projects - including grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd. Across these scans, Atlas uncovered more than 200 previously unknown vulnerabilities. Crucially, each finding was autonomously validated end to end by our agentic system, moving beyond model-generated suspicion to reproducible proof of a real security issue. The findings span a range of vulnerability classes and show Atlas reasoning about complex codebases that have already been analyzed, fuzzed, and reviewed over decades.
We are working on responsibly disclosing every finding to the relevant maintainers and are withholding technical details until fixes are available.
One of the more interesting findings from this research was the discovery of a critical RCE vulnerability in GitHub (CVE-2026-3854). This discovery – which resulted in the biggest bug bounty ever paid out in GitHub's history – serves as a powerful illustration of Atlas's capabilities: the researcher who uncovered the bug utilized an AI-augmented tool that served as an early version of the Atlas system. That same early version also played a key role in uncovering one of the most severe cloud vulnerabilities ever discovered, which we’ll discuss at our upcoming Black Hat talk.
Why a System, Not a Model
We set out to find a scalable way to apply frontier models to code security: one that could run deeply across many codebases, improve as models evolve, produce findings defenders can trust, and remain economically viable at continuous, enterprise-wide scale.
We designed Atlas around four principles:
Use the right model for each task. Exploit reasoning, triage, and scoped analysis require different strengths and cost profiles.
Make depth cost-efficient. Expensive frontier models should be reserved for the problems that require them, while smaller models handle well-scoped work at scale.
Build for constant model change. New models and capabilities should compound, allowing the system to improve continuously while keeping its underlying architecture stable.
Validate every result. Findings must move beyond plausible model output to reproducible, end-to-end proof.
Our conclusion was simple: the system compounds the value of the model. Scoping, orchestration, validation, and proof are what turn frontier-model capability into reliable security outcomes. Atlas is that system: specialized agents, each using the best engine for its task, working together like a security research team.
How Atlas Works
Atlas is structured as a set of specialized AI agents, each with a distinct job, that work a vulnerability the way a research team would: understanding the codebase, developing a lead, contesting it, and confirming it before reporting. The work is organized into discrete, named stages, and orchestrated programmatically rather than left to a single model to run end to end.
1. Map the attack surface. Before hunting, Atlas builds a structured threat model of the codebase - its entrypoints, where untrusted input enters, the paths that input can travel, and the dangerous operations it could eventually reach. It grounds this in a code property graph (CPG) rather than reading files in isolation, so its reasoning is anchored in real call and data-flow facts rather than inference from surrounding text.
2. Hunt in parallel. Multiple agents then investigate independently, each developing and testing its own hypotheses about how a weakness could be reached and triggered. Running several independent attempts and keeping only those that hold up is what allows Atlas to find the subtle, multi-step bugs that a single pass would miss.
3. Validate adversarially. Each candidate (vulnerability) is contested rather than accepted. One agent argues that the finding is genuinely exploitable, another argues that it is not, and a third weighs the evidence and decides. A finding survives only if it withstands an adversary actively attempting to refute it. Semantically equivalent candidates are then collapsed into a single finding, so a team isn't handed the same bug reported several ways. This adversarial stage is the biggest lever we have on keeping the false-positive rate down.
4. Prove by triggering. Rather than stop at static reasoning, Atlas builds a dedicated execution environment, installs the necessary dependencies, and runs the triggering input to validate the security-relevant behavior dynamically.
What Building Atlas Taught Us
Build through evals
Evals are repeatable, objective benchmarks that quantify AI system performance on critical tasks. Since AI outputs are probabilistic, effective evals must assess nuance and context.
We built Atlas using Evaluation-Driven Development, establishing strict quality metrics for every AI component and stage in the pipeline before making any changes. This approach proved critical because agent behavior is often counterintuitive: changes that seemed intuitively beneficial to an experienced security researcher frequently had no impact or even degraded vulnerability research results. By relying on objective evaluation rather than assumptions, we ensured every development decision, from prompt tweaks to model updates, was grounded in measurable improvements.
Take our validation eval that measures the performance of our validation layer's ability to accurately rate a candidate. The eval takes a set of vulnerability candidates, some are known FPs, while others are low, medium, high and critical severity TPs. We then invoke a version of our validation layer to rate these candidates, and measure its accuracy against the ground truth. This allows us to test new validation ideas, and compare their cost and performance.
A second finding shaped the entire architecture: today's frontier models are exceptional at narrow, well-scoped tasks, but far less reliable and consistent when asked to own an open-ended multi-step workflow from beginning to end. So rather than hand a model the goal of "find the bug," we decompose the work into the discrete stages above and orchestrate them programmatically. Letting deterministic code drive the workflow - and reserving the models for the reasoning steps they're genuinely best at - significantly outperformed LLM- and skills-driven orchestration.
Use the right model for each job
No single model is best at everything, and none stays state of the art for long. We evaluate every new model as it ships through Cyber Model Arena, and our internal benchmark suite that scores models across the specific tasks that make up an investigation - threat modeling, hunting, validation, and proof generation. The results are rarely uniform: the model that reasons best through a complex exploit chain is often not the one that triages most precisely. Atlas routes each stage to whichever model wins on that task.
In practice, Atlas doesn't rely on a single brain; instead, it operates as an autonomous set of specialized brains, each optimized for a specific stage of the research process. The architecture is intentionally dynamic: we reevaluate it whenever a new model arrives, using our eval framework to quickly determine whether it performs better for a given task and should replace or complement the existing engines.
Use a purpose-built harness
Driving these multi-model, multi-agent workflows took infrastructure that general-purpose coding agents weren't built for, so we built our own - a harness designed specifically for vulnerability research, tuned for the cost and performance profile of the work. This also allowed us to be model-agnostic by design. When a better model appears, we slot it into the relevant stage without rearchitecting anything. It's the same principle as the rest of the system: the harness compounds the value of whatever model is currently best for the task at hand. At its core, Atlas is a vessel designed to turn dollars spent into validated vulnerability findings. Whether we are changing models, upgrading tools, or optimizing pipeline steps, our goal is to ensure it remains the most efficient vessel possible.
The work ahead includes… more evals.
CyberGym is an invaluable benchmark, but it is important to be precise about what it does and does not measure. Each task gives the system a known vulnerability, including a description and the relevant code, and evaluates whether it can produce a working proof of concept that triggers the bug. That makes CyberGym the strongest public benchmark we know of for exploit reproduction, and a critical tool for developing and measuring Atlas against hard evidence rather than intuition.
But reproducing a known vulnerability is a different, arguably easier problem than discovering an unknown one. Real-world discovery starts from a blank page, with no description, no pointer to the vulnerable function, and a codebase that changes continuously. That is the harder problem defenders ultimately need solved, and one CyberGym does not measure. No public benchmark fully does today.
To continue improving Atlas, we are investing in additional evals designed to measure discovery, validation, and reproduction for previously unknown vulnerabilities. The goal is to ensure the system not only generates plausible candidates, but consistently surfaces the true vulnerabilities within the broader set of findings.
We also evaluate Atlas in the real world: testing whether it finds genuine vulnerabilities in heavily audited codebases and how precisely it distinguishes critical findings from low-signal noise.
What Atlas Means for Security Teams - and for Wiz Customers
AI is rapidly becoming more capable at cyber security, and each new generation of models expands what is possible. Over the past few months, as security teams have applied these models to real codebases, we have seen how powerful they can be. But we have also learned that pointing a frontier model at a codebase once is not a sustainable security strategy: deep scans are expensive, their results become stale as code changes by the minute, and a point-in-time analysis cannot provide the continuous coverage organizations need across every repository.
The defining question for code security in the AI era is not, “Which model does your scanner use?” It is, “How does your system take advantage of the best model available today, continuously and economically, and what continues to work when a better one arrives?” That is the bet behind Atlas: frontier-model depth where expert reasoning is required, an architecture that improves as models evolve, and rigorous validation so every finding arrives with evidence, not just a plausible answer.
What This Means for Wiz Customers
We are working to incorporate Atlas as part of Wiz Code, with a practical system for AI code scanning that combines continuous coverage with deep investigation.
Wiz Code will continuously evaluate every application and every change, identifying the areas that warrant more intensive analysis, such as sensitive components, suspicious data flows, exposed paths, or high-impact changes. Atlas and other specialized engines, including Google CodeMender, can then apply greater context, compute, and reasoning where they are most likely to uncover meaningful risk.
Every finding will flow into the same Wiz system. The Security Graph adds context across code, cloud, identity, runtime, and exposure; Red and Green Agents validate risk and build remediation plans. The result is continuous breadth, on-demand depth, and one source of truth for application risk.
Talk to a Wiz expert to learn more about how Wiz Code can help your organization secure applications in the AI era, starting in code.