Offensive AI gets the headlines; Scan for Good is Google and Wiz betting defenders can aim the same class of tools back at exposed critical systems — with humans still holding the merge button on fixes. Wiz announced the program on September 24, 2026 with Google DeepMind and CISA involvement, pairing Wiz Red Agent with Gemini 3.8 Flash Cyber to scan authorized public-facing assets for exploitable paths.
If you ship agents that touch browsers, CI, or customer infrastructure, this is the compliance shadow to OpenAI's Medicare portal breach week: autonomous scanners are now hunting the mistakes agents make.
TL;DR: Scan for Good
| Question | Answer |
|---|---|
| Who | Wiz (Google-owned) + Google DeepMind + CISA guidance |
| Models | Gemini 3.8 Flash Cyber + Wiz Red Agent |
| Targets | Authorized public web/API/app surfaces |
| Sectors | Critical infrastructure, public services, nonprofits |
| Reported findings | 475 critical/high issues (Wiz project page) |
| Human role | Validate, coordinate remediation |
| Price | Free scanning for qualified orgs (apply via Wiz) |
What Wiz and DeepMind built
Wiz's blog frames Scan for Good as ecosystem-scale defense: AI to find exposures before criminals do, especially for under-resourced operators. Google DeepMind contributed frontier cyber performance from Gemini 3.8 Flash Cyber — the same cyber-tuned Flash line Google shipped in the Gemini 3.6 / 3.8 Flash wave.
Red Agent is Wiz's pentesting-oriented agent. The Register reported it autonomously found a script injection in Snowflake's public snowflake-connector-net repo via GitHub Issues titles that could execute commands in Actions runners — a vulnerability class every agent-with-CI startup should fear.
Other disclosed wins include:
- A public rail operator production database exposing admin sessions (route and schedule disruption risk).
- Hospitals with access-control and remote-code-execution issues.
- A national archive web app where weak access control could allow unauthorized deletions.
Wiz promises more anonymized pattern write-ups — useful training material for red teams.
Why this landed the same week as agent panic
Scan for Good dropped alongside:
- White House pushes for US-first model testing after agent incidents.
- Private SAFA safety standards talks among frontier labs.
- Public UN Security Council warnings from OpenAI and Anthropic.
The narrative converges: agents are dual-use. Scan for Good is Google's attempt to show defender-first agent deployment with CISA applause — countering fear that Gemini-class models only help attackers.
What this means for what you build or pay
Harden CI and public repos. If Red Agent found Snowflake's issue from the outside, assume scanners will probe your GitHub Actions, fork workflows, and issue templates. Use read-only tokens, sandbox runners, and no secret-bearing pull_request_target patterns without review.
Agent surface area audit. Map every URL your agent can fetch or POST. Medicare-style breaches start with over-scoped tools. Pair with OpenAI agent deception eval research mindset — test malicious sites in staging.
Cyber-tuned models for defense. Gemini Flash Cyber is a SKU direction, not a chat gimmick. If you run security agents, benchmark cyber models against general frontier models on your findings corpus before paying flagship prices.
Apply if you operate critical services. Wiz invited infrastructure operators to apply for free scanning — relevant to health, transit, and municipal tech teams, not just FAANG.
How Red Agent and Gemini Flash Cyber fit together
Wiz describes Red Agent as an autonomous pentesting-oriented agent: it chains reconnaissance, hypothesis generation, and exploit validation across web apps, APIs, and — critically — developer supply-chain surfaces like public GitHub repos. Gemini 3.8 Flash Cyber is the cyber-tuned Flash variant Google positioned in the July 2026 Flash launch wave: faster and cheaper than flagship Gemini for security-classification and attack-path reasoning.
The pairing is deliberate: Red Agent proposes actions; cyber-tuned models rank paths and parse responses; human researchers confirm exploitability before coordinated disclosure. That loop mirrors how mature bug-bounty programs work — except the first pass is machine-speed.
For builders shipping browser tools or CI integrations, the Snowflake GitHub Actions finding is the case study to internalize. A malicious issue title should never become code execution on a runner with secrets. Scan for Good found that class of bug from the outside; your threat model should assume Red Agent-class scanners (ethical or not) will too.
Reported findings in plain language
| Category | Reported impact | Lesson for agent teams |
|---|---|---|
| Railroad operator DB | Session and operational data exposure | Default-deny public DB endpoints |
| Hospitals | Access control + RCE class issues | Clinical systems cannot tolerate agent-driven scans without auth |
| National archive | Weak ACLs on destructive actions | Role checks on delete paths, not just UI hiding |
| Snowflake OSS repo | GitHub Actions script injection | Sanitize issue/PR metadata before shell expansion |
| Aggregate (Wiz) | 475 critical/high issues | Volume implies automation + human triage at scale |
Wiz promises anonymized pattern posts — treat those as free secure-design lectures when they drop.
Scan for Good vs bug bounty vs internal pentest
| Approach | Cost to defender | Attacker model | AI role |
|---|---|---|---|
| Scan for Good | Free (qualified orgs) | Ethical, authorized | Red Agent + Gemini Cyber |
| Bug bounty | Ongoing payout | Incentivized researchers | Humans + optional AI assist |
| Internal pentest | Consultant / staff time | Simulated adversary | Mixed |
| Rogue agent crawl | Incident response cost | Uncontrolled | What policymakers fear |
Scan for Good is not a replacement for bounty programs or compliance audits. It is capacity amplification for sectors that cannot afford continuous red teams — and a marketing proof that Google’s cyber models have defender deployments, not just benchmark slides.
Same-week policy context (why CISA matters)
Scan for Good landed when Washington and the UN were loudly debating agent risk: US-first frontier model access, private SAFA safety body talks, and Medicare-adjacent breach headlines in the same news cycle. CISA praise (quoted in Cybersecurity Dive and The Register) gives Wiz policy air cover — defensive scanning as national infrastructure hygiene, not offensive AI proliferation.
If you sell agent products to government or healthcare, expect procurement questionnaires to ask how your tools behave when third-party scanners probe customer endpoints. “Our agent would never attack that” is weaker than “Our agent cannot be invoked to port-scan external hosts without admin enablement.”
Agent builder hardening checklist
- Inventory public URLs — admin panels, debug routes, unauthenticated webhooks.
- CI threat model — fork PRs, issue titles, comment bodies, workflow_dispatch inputs.
- Tool scoping — each agent tool gets least privilege; no blanket
run_shell. - Deception testing — adapt ideas from OpenAI tool-call spoofing evals for your harness.
- Cyber model eval — before paying flagship prices for security agents, benchmark Flash Cyber-class models on your own finding types.
- Incident playbooks — assume disclosure emails from programs like Scan for Good are legitimate until verified via vendor channel.
OpenAI and Microsoft parallel moves
Defender-side agent stories are clustering in 2026. OpenAI’s Defense Factory cyber agents and Microsoft’s Eviltokens takedown work sit in the same narrative bucket: frontier labs want to show counter-abuse investment. Scan for Good is Google-Wiz’s entry — tied to Gemini SKUs you may eventually run on Vertex or AI Studio (preview docs context).
Agent search infrastructure has cost implications too: Perplexity Photon shows how retrieval-heavy agents compress $/query — relevant when your agent exposes a public search API that scanners might abuse for recon.
Who should apply (and who should not)
Good fits: transit authorities, regional hospitals, municipal digital services, nonprofits operating public benefit APIs, open-source maintainers of infrastructure-adjacent libraries (with org approval).
Poor fits: stealth startups in pre-launch, apps without clear authorization to test, teams that cannot remediate within disclosure timelines. Free scanning still consumes engineer time when findings arrive.
Wiz’s program page defines eligibility — do not point lab agents at production without written scope.
Skills, tools, and agent frameworks
If your product composes agent skills or MCP tools that touch customer networks, Scan for Good is a reminder that skill bundles increase attack surface. Document which skills perform outbound HTTP, shell, or git operations; customers will ask after the next critical finding press cycle.
What people are asking
Is Scan for Good offensive hacking?
Only on authorized targets with operator consent. Wiz emphasizes human verification before disclosure — unlike rogue agent crawls that triggered government alarm.
Does this replace human pentesters?
No. It accelerates triage. Humans still validate exploitability and coordinate fixes — same pattern SAFA wants for model safety audits.
Will Gemini Cyber be on Vertex for private scans?
Wiz uses Gemini via DeepMind partnership; public productization for your VPC may follow Google's cyber model roadmap — watch AI Studio and Vertex release notes (Gemini API preview docs).
Can I run Red Agent myself?
Red Agent is Wiz’s internal/agent product narrative; Scan for Good is operated by Wiz with partner models — not a downloadable open-source scanner. Build your own agents with cyber-tuned models plus human review instead of expecting a Red Agent tarball.
Does Scan for Good scan private VPCs?
Public-facing authorized assets are the stated scope. Internal VPC pentests still require traditional contracts and scope letters.
How does this relate to Anthropic barring UK AISI testing?
Policy fights over who may test frontier models (Anthropic UK AISI coverage) run parallel to who may scan public infrastructure. Both are about authorization and governance — not whether AI assists the tester.
Related on explainx.ai
- Gemini 3.6 Flash and Flash Cyber launch
- OpenAI Defense Factory cyber agents
- Microsoft Coinbase Eviltokens takedown
- White House US-first model access
- Perplexity Photon — defensive cost of agent search
- What are agent skills?
Impact numbers and case studies follow Wiz and press reporting through September 25, 2026. Scan eligibility and scope are defined by Wiz program terms.