Offensive Harness Design: Engineering Agents for Static Analysis - Tselevich & Maturi - OAIC

Speakers: Alex Tselevich, AI Capability Development & Michael Maturi OffSec Technical Manager @ Google Mandiant Everyone can wrap a model in a loop and call it a vulnerability scanner. Getting one to reliably find real, reachable bugs in a 10-million-line codebase without drowning the user in false positives is a different problem entirely, which lives in the harness, not the model. This talk is a practitioner's blueprint for engineering offensive static-analysis harnesses that orchestrate LLM agents to discover and validate vulnerabilities in source code. We walk the full design spectrum from fully semantic to fully graph-driven analysis, and share the architecture, trade-offs, and hard-won lessons from building a harness now used across Mandiant and Google. Offensive AI Con 2026