Security engineering has an AI problem. As development teams rush to integrate generative AI into their continuous integration pipelines, they are quickly discovering that conventional AI vulnerability scanners are relentlessly noisy.
Most of these tools operate blindly flagging non-existent “hallucinated” bugs, misunderstanding context, and dragging true-positive rates down into the single digits, often below 7 percent.
To solve this alert fatigue, Google recently open-sourced Mantis, an AI-agent framework designed to automate the entire software vulnerability lifecycle. Available on GitHub, Mantis doesn’t just look for flaws; it identifies, validates, reproduces, and even patches them.
Rather than relying on a single, massive prompt to find security gaps, Google engineered Mantis as a collaborative suite of specialized AI agents working at machine speed.
The End of Brute-Force Code Scanning
Traditional AI scanners fail because they ingest code without a broader understanding of the software’s architecture.
Feeding raw files into a large language model strips away the context necessary to distinguish between a theoretical risk and an actual exploit. Mantis approaches the codebase more like a human security researcher.
It begins by analyzing repository history, past security fixes, dependency graphs, and overarching threat models.
To make this efficient, Mantis summarizes these files into a hierarchical context tree. This preserves directory-level and repository-level structure while slashing LLM token usage by 85 percent. Once the context is mapped, a modular skill suite of over 15 tools which can run sequentially or in parallel goes to work.
The framework relies on distinct agentic personas communicating through a shared state stored on disk. A strategist agent maps out high-level code structures, while research agents use internal searches to trace complex data flows, control logic, and sanitization routines deeply buried in the source files.
When these agents flag potential issues, critic and reviewer agents step in. Using tools like mantis-review and mantis-critic, these secondary agents apply rule-based negative filters to weed out obvious false positives.
However, Google notes this filtering requires a delicate touch; overly aggressive negative filters risk masking genuine, low-risk vulnerabilities.
Sandboxed Proof and Multi-Model Efficiency
Even with intelligent filtering, the only way to definitively prove a vulnerability isn’t an AI hallucination is to exploit it. This is where Mantis fundamentally separates itself from static analysis tools.
Instead of just warning developers about a potential memory leak or injection flaw, Mantis attempts to execute the exploit. The mantis-reproduce agent writes functional crash reproducers and executes them in a secure, sandboxed environment.
This provides concrete evidence that the vulnerability exists and can be triggered, removing the LLM’s sole “judgment” from the final verification step. If the exploit works, the mantis-patch agent is deployed to generate a side-effect-free fix for the codebase.
Running an operation this complex solely on massive frontier models would be prohibitively slow and expensive. Google designed Mantis to dynamically pair different model classes to the task at hand.
For tasks lacking logical depth such as rapid classification (mantis-researcher) or grouping similar text patterns (mantis-dedupe) the framework uses lightweight “flash” or “lite” models.
The heavy lifting is reserved strictly for tasks requiring deep contextual understanding and zero-shot reasoning, like generating the final sandboxed reproducers and functional code patches.
By combining contextual awareness, adversarial agent teams, and verifiable sandboxed reproduction, Mantis shifts the paradigm of automated security.
It moves the industry away from generating endless lists of unverified alerts, focusing instead on delivering provable, patch-ready vulnerabilities.
Source: InfoQ, "Google Mantis: An Agentic Vulnerability Scanning Harness for Reducing False Positives"
