Google Deploys New AI Security Agents to Hunt Threats

Google Cloud, led by Francis deSouza, announced three new AI security agents in preview and a set of supporting governance services at Cloud Next 2026. Google framed the shift as an "AI-led defense" driven by an agentic fleet that performs large-scale threat hunting and other routine cyber security work while humans oversee decisions. The company highlighted its vertical integration across chips, models, and cloud tooling as a differentiator for deploying these agents at scale.

The new agents expand last years security agents and the earlier Wiz integrations. The lineup announced includes three new agents:

• •Threat Hunting agent, which performs continuous, large-scale hunting for stealthy behaviors using Google Threat Intelligence and Mandiant best practices.
• •Two other agents were introduced in preview; Google did not detail their specific names or functions in this report.

Google emphasized integrating model outputs with existing telemetry and Mandiant playbooks rather than replacing them. The company also announced governance and safety-focused services to secure the fleet, without detailed public descriptions of the specific controls. Google repeatedly referenced its internal model pipeline and chip design as reasons it can adapt to new model capabilities quickly.

Enterprises and MSSPs already struggle with alert fatigue and staffing shortages, so automating hunting and routine response is a logical next step. Google is competing with other cloud and security vendors that are embedding large language models and agents into security operations. The key differentiator is Googles claim of tighter model-to-product feedback and access to its global telemetry and Mandiant threat intel. However, agentic automation introduces new risks: runaway automation, adversarial attempts to manipulate agents, and expanded attack surfaces if agents are compromised. Googles simultaneous release of governance tooling acknowledges these risks but leaves open how robust those controls are in adversarial scenarios.

Evaluate these agents in a controlled environment before broad deployment, focusing on agent decision boundaries, auditing, and escalation paths. Watch for technical detail releases about model architectures, fine-tuning, and the specific remediation APIs that agents can call, plus third-party red-teaming results and early customer case studies.