Google has open-sourced Mantis, an agentic vulnerability scanning harness designed to automate more of the security workflow than a conventional code scanner. The company says the framework is intended to identify, validate, reproduce, and even help fix vulnerabilities while cutting down the false positives and hallucinated bugs that often undermine AI-powered security tools.
Google Mantis aims at a familiar problem in AI security tools
According to Google, one of the biggest weaknesses in current AI code scanning is reliability. The company says sloppiness in AI-driven analysis frequently leads to hallucinated bugs and weak true-positive rates under 7%, making many findings difficult to trust. Mantis was built to improve that picture by combining agentic techniques with sandboxed reproduction so results can be grounded in evidence rather than only in an LLM’s judgment.
In practice, that means Mantis does not simply scan source files in a brute-force way. Google says it analyzes repository history, prior security fixes, architecture, and threat models before it starts making claims about possible vulnerabilities. The result is meant to be a more informed process that understands the codebase in context, rather than treating every file as an isolated target.
How Mantis uses context to reduce noise
A key part of the framework is its use of repository-wide structure. Google explains that Mantis summarizes analyzed files into a hierarchical tree that captures directory-level and repository-level context. That approach reportedly reduces token usage by 85% while preserving important structural information, which can help the system scale without consuming excessive compute or context window budget.
This is important because vulnerability detection often fails when tools lose track of how components relate to each other. A single file may look suspicious in isolation, but security relevance may depend on how data flows through the broader application. By incorporating history, architecture, and threat model data, Mantis is designed to reason over those relationships before making conclusions.
Google describes the framework as part of its internal approach to finding and fixing vulnerabilities at machine speed. In that model, automated analysis is not the end of the process; it is one stage in a broader pipeline that aims to move from discovery to remediation more efficiently.
Agentic workflow: strategist, researcher, critic, and reviewer
Mantis relies on a modular, multi-agent workflow rather than a single model acting alone. Google says the system includes a strategist agent that evaluates high-level code structure, threat models, and dependency graphs. It also uses research agents that search internal code and examine source files in depth, tracing data flows, control flows, and sanitization logic.
Beyond those, Mantis includes critic and reviewer agents that help filter false positives and surface findings that are more likely to matter. This layered design reflects a broader pattern in agentic systems: one model may generate candidates, while others challenge, narrow, or validate those candidates before a result is accepted.
The goal is not to maximize the number of findings. Instead, Google is trying to improve signal quality so security teams spend less time chasing weak alerts and more time acting on vulnerabilities that can be demonstrated and reproduced.
Sandboxed reproduction adds evidence to the pipeline
One of Mantis’s most notable features is its ability to reproduce findings in a sandboxed environment. Google says this provides evidence that a reported issue is a real vulnerability in a safe and controlled way, rather than depending only on the model’s internal reasoning. That distinction matters because many AI-based scanners can describe plausible flaws without showing that the flaw can actually be triggered.
Sandboxed reproduction also helps separate theory from proof. If a vulnerability can be reproduced, security teams have a stronger basis for prioritization, triage, and eventual patching. If it cannot, the finding may still be useful as a lead, but it is less likely to be treated as a confirmed issue.
This approach reflects a broader shift in AI-assisted security toward verification. Rather than asking models to merely speculate about risk, Mantis tries to connect analysis with executable evidence wherever possible.
A modular suite with more than 15 tools
Google says Mantis is organized as a modular skill suite containing more than 15 tools. These can be executed sequentially or in parallel, and include stages such as mantis-summarize, mantis-review, and mantis-critic. The stages share information by reading and writing state stored on disk, which helps coordinate work across the pipeline.
That design makes the system easier to adapt to different workflows. Some stages can narrow the search space quickly, while others can apply deeper analysis where needed. The shared-state approach also suggests Mantis is intended as a composable harness rather than a one-size-fits-all product.
- Strategist: evaluates broad structure, threat models, and dependencies
- Research agents: inspect code paths, data flows, control flows, and sanitization logic
- Critic and reviewer agents: filter likely false positives and prioritize useful findings
- Reproduction tools: validate issues in a sandboxed environment
- Patch generation tools: help produce side-effect-free fixes
Google says different models fit different stages
Mantis also supports multiple models, and Google recommends using different model classes for different jobs. The company says heavy frontier models are not necessary at every stage, and that faster “flash” or “lite” variants can be used for tasks that do not require deep reasoning.
Examples Google gives include rapid classification tasks with mantis-researcher and clustering similar text patterns with mantis-dedupe. More capable models are better suited for demanding stages such as mantis-reproduce, which writes functional crash reproducers, and mantis-patch, which generates side-effect-free code fixes.
That separation of labor is a practical response to cost and latency. It also reflects the idea that not every security task benefits from the most expensive model available. A pipeline that matches model size to task complexity can be more efficient and easier to operate at scale.
The role of false-positive filtering
False positives remain one of the most frustrating issues in vulnerability scanning, and Google says every system produces them to some degree. Mantis addresses this with the mantis-review stage, which applies a rule-based negative filter to eliminate likely false positives.
At the same time, Google warns that the filter must be used carefully. Low-risk findings should not automatically be classified as false positives, because an overly broad filter could suppress real vulnerabilities and weaken the system’s coverage. In other words, the framework is trying to reduce noise without becoming blind to subtle but genuine issues.
That caution is important in security tooling, where both false positives and false negatives have real costs. A scanner that is too aggressive can overwhelm teams with noise, while one that is too conservative can let issues slip through.
Open source availability and documentation
Google says Mantis is available on GitHub. The company also points users to an agent reference guide for a detailed breakdown of the available stages, the contracts between them, and best practices for using the framework.
As presented by Google, Mantis is less a traditional scanner than an orchestration layer for AI-assisted security work. Its emphasis on context, validation, and staged decision-making suggests the company is trying to move AI vulnerability detection from plausible-sounding guesses toward a more verifiable workflow.
For teams evaluating AI security tools, that distinction may matter as much as raw detection volume. A system that finds fewer issues but can validate them more reliably may be more useful than one that produces a larger pile of uncertain alerts.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: September 6, 2026 at 10:32 pm
3 views
