Google Open-Sources Mantis to Replace Noisy AI Code Scans with Validated Exploit Proofs

Google has open-sourced Mantis, a modular AI harness designed to automate the entire software vulnerability lifecycle across discovery, triage, sandboxed reproduction, and verified remediation. Originally developed as part of Google's internal security engineering toolkit, the framework organizes more than 15 specialized agent skills covering structural indexing, threat modeling, negative-rule filtering, and patch generation. Rather than brute-forcing full codebases into large context windows, Mantis constructs a hierarchical security summary tree that condenses repository structure into directory- and root-level summaries, reducing LLM token consumption by over 85 percent while preserving vital architectural context. For enterprise practitioners, the primary bottleneck in automated security has never been finding potential anomalies—it has been filtering out hallucinations and benign code patterns. Naive AI scanners routinely deliver true-positive rates under 7%, burdening developers with alert fatigue. Mantis counters this by implementing an evidence-grounded verification pipeline. Candidate flaws identified by researcher agents are challenged by critic and reviewer agents before passing to a reproduction agent, which generates functional proof-of-concept crash scripts. A vulnerability is only confirmed when it demonstrably crashes within an isolated sandbox, ensuring remediation efforts focus exclusively on reproducible, high-risk flaws. This release reflects a broader industry movement toward autonomous DevSecOps and verifiable agentic workflows. As threat actors leverage AI to identify and weaponize flaws at machine speed, defensive workflows cannot rely on manual triage queues or static rulesets alone. Mantis operationalizes principles from Google's Secure AI Framework (SAIF) and shifts security from reactive inspection to self-healing codebases. Architecturally, it also demonstrates cost-effective agent tiering: lightweight models handle classification and deduplication, while reasoning-intensive frontier models are reserved for complex threat modeling and exploit synthesis. In practice, security and DevOps teams should approach deployment with deliberate isolation controls. Because Mantis generates and runs active reproducer code, workloads must execute in locked-down environments—such as dedicated VMs or containers running networkless runtimes like gVisor. Teams should initiate rollout in interactive human-in-the-loop mode to calibrate repository-specific negative filters before granting auto-patching permissions. Furthermore, platform teams can feed validated findings back into IDE coding assistants via the mantis-advise skill, closing the feedback loop and preventing recurring vulnerability patterns during initial authoring.