Wiz built an AI system called Atlas to find security flaws before hackers do. This year, Wiz says Atlas found more than 200 previously unknown vulnerabilities across open source software, including code that has been reviewed for years.

That 200-plus figure is a count of what Atlas found, not a count of disclosures already sent to maintainers. Wiz may be sequencing the rollout, holding details back while it works privately with affected projects. That strengthens the underlying problem rather than softening it. AI-assisted research can now generate validated vulnerabilities faster than maintainers, coordinators, and downstream users can assess, patch, test, and deploy fixes.

Every one of those flaws now has to go through the same process: alert the maintainers, confirm it's real, write a fix, test it, release it, all before attackers find out. That process was built for one report at a time. Atlas produces them in batches.

Atlas Is Designed to Validate Its Findings

Atlas works like a small research team, not a single chatbot. One part studies the software to find where it might break. Multiple copies then search for flaws at once, each on its own trail. When one finds something, other copies argue over whether it's real or a false alarm. Wiz says survivors move to a final step, where Atlas builds a proof-of-concept exploit, aiming to distinguish exploitable vulnerabilities from theoretical issues and false positives before anything gets reported.

An early Atlas finding in GitHub.com reportedly led to a $100,000 reward, described as GitHub's largest bounty paid to a researcher. Wiz is holding back details on the other 200-plus flaws until the affected software gets patched. That's the responsible move for one disclosure. It gets harder to sustain as the volume climbs.

Google Owns Both Ends of This Pipeline

Google Cloud completed its acquisition of Wiz on March 11, 2026. Google DeepMind developed CodeMender, a separate AI agent designed to help identify and repair security vulnerabilities, now available in preview on Google Cloud's security platform. During its first six months of development, CodeMender upstreamed 72 security fixes to open source projects, each reviewed by a human researcher before submission.

Kubernetes and Linux kernel maintainers still control what goes into their code. Nobody outside Google can force a patch through. But one company now sits on both ends of a process that used to run through many independent researchers and maintainers.

About Shashi Bellamkonda

Loading bio…

LinkedIn Profile

Get new posts by email:

Subscribe

Powered by