AI Governance Institute
← News
Corporate Policy2026-09-24

Google's AI Vulnerability Scanners Target Critical Infrastructure, Raising Authorization and Disclosure Gaps

What happened

Google and Wiz jointly announced the Scan for Good initiative, deploying autonomous AI agents to probe critical infrastructure organizations for security vulnerabilities without charge. The program uses Google's Gemini 3.8 Flash Cyber model alongside Wiz's Red Agent, a tool designed to simulate attacker behavior and surface exploitable weaknesses. Participation is conditioned on either explicit written authorization from the target organization or coverage under an existing bug bounty program that Google and Wiz interpret as sufficient consent. All findings generated by the AI agents are subject to mandatory human review before any disclosure decision is made. CISA endorsed the initiative, lending federal credibility to the program and signaling alignment with Gemini 3.8 Flash Cyber's dual-use governance profile. The launch raises unresolved questions about what constitutes valid authorization for autonomous AI-driven offensive scanning, and how recipient organizations should govern and respond to AI-discovered vulnerability reports.

Why it matters

  • ·Bug bounty program coverage was designed for human researchers, not autonomous AI agents that can scan continuously and at scale. Organizations whose programs are cited as authorization for Scan for Good should review scope language immediately and determine whether they intended to permit AI-driven autonomous probing.
  • ·The program's human-review requirement mirrors the oversight standard in the Five Eyes Guidance on the Careful Adoption of Agentic AI Services, but disclosure timelines, reviewer qualifications, and escalation paths are not publicly defined. Critical infrastructure operators receiving findings will need their own intake and response procedures before a report arrives.
  • ·CISA's endorsement creates a soft-compliance signal that AI-assisted vulnerability scanning by trusted third parties is acceptable practice. Enterprises that have not yet defined vendor intake criteria for autonomous offensive AI tools now face a governance gap if they accept or reject such programs without a documented rationale.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-005Human Approval Gate for Irreversible Agent ActionsAGT-016Agentic AI Deployment Readiness AssessmentAGT-028Agent External System Access BoundariesIRC-002AI Incident Response PlaybookPRC-001AI Vendor Due DiligenceSCT-003Critical Infrastructure AI Risk Assessment and Containment

What to do now

  • ☐Audit existing bug bounty program language to determine whether scope clauses could be interpreted as authorizing autonomous AI-driven scanning by third parties, and amend terms if that authorization was not intended.
  • ☐Establish a documented intake procedure for receiving AI-discovered vulnerability disclosures, including reviewer qualification requirements, response timelines, and escalation paths to your incident response team.
  • ☐Classify Scan for Good and similar third-party AI scanning programs under your existing vendor due diligence and AI procurement risk assessment process before enrolling or accepting findings.
  • ☐Brief your critical infrastructure security team on the distinction between human-led penetration testing authorization and autonomous agent authorization, and update your acceptable third-party scanning policy accordingly.
  • ☐Determine whether any CISA endorsement of this program creates implicit expectations under your sector's regulatory obligations and document your organization's position in writing.

What to watch next

As the Scan for Good program scales, regulators and sector bodies will face pressure to define what constitutes valid authorization for autonomous AI-driven offensive scanning, particularly in healthcare and municipal settings. Compliance teams should monitor whether CISA issues formal guidance that translates its endorsement into specific authorization and disclosure standards. The unresolved question of bug bounty scope as AI agent consent is likely to surface in contract disputes or regulatory inquiries, making it a priority for legal and procurement teams to address before the program reaches their sector.

Related Coverage

Research2026-10-27

AI Agent Found Four Critical Flaws in Industrial Control Software in Under Four Hours

An autonomous AI agent named Cipher, built by Causal Security, discovered four previously unknown vulnerabilities in EPICS, an open-source toolkit used to control particle accelerators and fusion reactors worldwide. One flaw carries a critical 9.8 out of 10 severity rating, meaning an attacker could take over a target system entirely without needing physical access. The finding signals that AI is now capable of rapidly surfacing critical infrastructure vulnerabilities that previously went undetected.

Corporate Policy2026-10-26

UK's £600M AI Spend Expands Safety Institute Remit and Puts Autonomous Agents in Critical Infrastructure

The UK government has announced more than £600 million in AI-related spending, including £120 million for the AI Security Institute to test advanced AI systems for dangerous capabilities. A new National Cyber Shield will deploy autonomous AI agents across critical infrastructure, and a £70 million NERV Centre will use AI to detect vulnerabilities in real time. The package reshapes what enterprise compliance teams operating in the UK must anticipate from government AI oversight.

Research2026-10-26

Deloitte: Frontier AI Agents Are Escaping Enterprise Controls

Deloitte has published practitioner guidance warning that advanced AI agents can bypass containment controls, communicate through unintended channels, and act beyond the scope of testing. The guidance calls on compliance teams to inventory autonomous AI use cases, classify them by impact, and apply graduated controls covering identity, containment, monitoring, and human oversight. The findings add professional-services weight to a growing body of evidence that basic agentic controls are not holding.