Google has open-sourced Mantis, an AI-agent framework designed to automate the software vulnerability lifecycle, from identifying and validating vulnerabilities to reproducing and fixing them. Google says it developed Mantis to address the high rate of false positives and hallucinated vulnerabilities produced by conventional AI-powered code scanning.
While sloppiness in AI code scanning frequently leads to hallucinated bugs and weak true-positive rates under 7%, we designed Mantis to be effective by combining industry-standard agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities for grounding.
Google explains that Mantis analyzes repository history, previous security fixes, architecture, and threat models rather than blindly scanning files using brute force. It then summarized the analyzed files into a hierarchical tree containing directory and repository-level context, reducing token usage by 85% while retaining important structural information.
Mantis uses industry-standard agentic techniques, such as critic and reviewer agents to filter out false positives and prioritize meaningful findings. It can also reproduce findings in a sandboxed environment, providing evidence that a finding is a real vulnerability in a safe and controlled way, rather than relying solely on the LLM's judgement.
Mantis is part of Google's "[internal approach to find and fix vulnerabilities at machine-speed]"(https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-how-google-cloud-security-uses-ai-internally). In addition to critic and reviewer agents, Mantis uses a strategist agent to evaluate the high-level code structure, threat models, and dependency graphs, as well as research agents that use internal code searches to examine raw source files in depth, tracing data flows, control flows, and sanitization logic.
Mantis is organized as a modular skill suite including over 15 tools that can be executed sequentially or in parallel, including mantis-summarize, mantis-review, mantis-critic, and many more. The stages communicate with one another by reading and writing to a shared state stored on disk.
Mantis supports multiple models as well as combining different models for different phases:
To maximize the speed and efficiency of your automated pipeline, you should strategically pair the right AI model class with the specific task. You do not need to use the heaviest, most advanced frontier models for every stage.
For example, Google recommends using a "flash" or "lite" model variant for tasks that do not require logic depth, such as rapid classification tasks using mantis-researcher or clustering of similar text patterns with mantis-dedupe. More powerful models are better suited for tasks requiring deep contextual understanding and zero-shot problem solving, such as mantis-reproduce, which writes functional crash reproducers, and mantis-patch, which generates side-effect-free fixes for the codebase.
Every vulnerability scanning system inevitably produces false positives, sometimes in a "frustrating number". Mantis addresses this with the mantis-review stage, which applies a rule-based negative filter to eliminate likely false positives. However, Google emphasizes that the filter should be used cautiously: low-risk findings should not automatically be classified as false positives, as an overly broad negative filter could reduce the system’s ability to detect genuine vulnerabilities.
Mantis is available on GitHub. You can get a detailed breakdown of all available stages and inter-stage contracts, along with best practices for using the framework, in the agent reference guide.