Google has open-sourced Mantis, an agent framework that investigates software vulnerabilities from initial detection through validation, reproduction and repair. The project is designed to reduce the false alarms and invented flaws that can make language-model code scanners expensive to review.
Instead of scanning files without context, Mantis examines repository history, earlier security fixes, architecture and threat models. It summarizes that material into a hierarchy spanning files, directories and the full repository; Google says this cuts context-token use by 85 percent while retaining structural information.
The workflow assigns critic and reviewer agents to challenge findings before they are prioritized. A suspected flaw can then be reproduced inside a sandbox, providing executable evidence rather than relying solely on a model’s written explanation. Google says conventional AI scanning can have true-positive rates below 7 percent, although teams should evaluate Mantis against their own code and threat model rather than treating that comparison as universal.
Open sourcing makes the harness available for inspection and adaptation, but it does not remove the need for human security review. Reproduction environments must remain isolated, proposed patches can introduce regressions, and repository access should be limited because the agents process source code, history and potentially sensitive security context.