Mantis Is Google's Answer to a Problem AI Itself Created

Naive AI code scanners hallucinate bugs and get it right less than 7% of the time. Mantis is Google's open-source attempt to fix that: a chain of AI agents that don't trust each other's findings until a bug proves itself in a sandbox.

AI models can now find and exploit software vulnerabilities largely on their own. That's not a hypothetical, it's the premise Google states outright when explaining why it built Mantis: AI has effectively erased the old patching window, the comfortable gap defenders used to have between a bug being found and it being fixed. If attackers now move at machine speed, defenders who still rely on manual review are already behind.

The obvious response is to throw AI at the defense side too. Plenty of companies have. Most of it doesn't work very well, and Google is unusually blunt about that: naive AI-powered code scanning frequently hallucinates bugs and lands a true-positive rate under 7%. Read that number again. Out of every hundred "vulnerabilities" a sloppy AI scanner flags, fewer than seven are typically real. That's not a tool, that's noise with a security badge on it.

Mantis is Google's attempt to fix that, and it's now open source. Here's what it actually is, how it works, and where the case for it holds up, and where it doesn't.

What Mantis Actually Is

Mantis isn't one AI model you point at a codebase. It's a toolkit, more than fifteen modular "skills," built for AI coding agents (Gemini CLI, Antigravity, or in principle any agent framework you already use). Each skill does one narrow job, and they run in sequence, passing findings to each other through a shared state on disk, like stations on an assembly line rather than one model trying to do everything at once (GitHub; InfoQ).

A quick honesty point, because I'd rather not let anyone assume more than what's actually being offered here: the public repo is explicitly a demonstration. Google's own README says this isn't an officially supported product and isn't meant for a production environment. What Google runs internally, the version actually protecting Google Cloud and its customers, is described as a "more full-fledged version" built on the same core ideas (Google Cloud Blog, June 2026). So what you're getting on GitHub is the engine design, not the production car.

The Trick Isn't the AI. It's the Tree.

Here's the part that should carry more weight than it usually gets in AI-hype writeups: Mantis's real innovation isn't "we pointed an LLM at your code." It's how it avoids reading your code the dumb way.

Instead of brute-force ingesting every file, Mantis first builds a hierarchical security summary tree. File-level summaries roll up into directory summaries, which roll up into a root-level picture of the whole repository. Google reports this cuts token overhead by more than 85%, while keeping the structural context that actually matters for spotting a vulnerability that spans multiple files (Google Cloud Blog; InfoQ). It also mines the repository's commit history first, so it's learning from your team's own past security fixes before it goes looking for new ones, rather than starting from zero every single run.

That's the unglamorous, unsexy part of the system, and it's also the part doing most of the real work.

Every Bug Has to Prove Itself First

Any system that generates thousands of findings will drown you in false positives eventually. Mantis's answer isn't a bigger model. It's a chain of skeptics:

A strategist agent looks at architecture, threat models, and dependency graphs to decide where to even bother looking.
Research agents dig into the actual source, tracing data flow, control flow, and sanitization logic.
A deduplicator, a reviewer, and a critic agent each take a pass at the raw findings, merging duplicates and stripping out weak or non-viable ones.
Only then does a finding reach the reproduction sandbox, which writes a working proof-of-concept and runs it in an isolated, network-disabled environment to confirm the bug is real, not just plausible-sounding (Google Cloud Blog, June 2026).

That reproduction step is the whole point, honestly. It's the difference between an AI insisting a bug exists and an AI showing you the crash. Google is careful to add a caveat that matters: a failed reproduction doesn't automatically mean the finding was false, and the negative filter used in review has to be tuned carefully, because being too aggressive about dismissing "low-risk" findings can quietly blind the system to real ones (InfoQ).

Once something is confirmed, mantis-chain can link several small, proven bugs into a single exploit path, and mantis-patch writes an actual fix, one that has to survive a regression loop before it's ever handed to a human reviewer.

This Isn't a Standalone Tool. It's One Piece of a Bigger Bet.

If you only read the GitHub repo, Mantis looks like a nice, self-contained security utility. It isn't, not really. Inside Google, Mantis is one module in a much larger agentic pipeline that touches the whole software lifecycle: agents that gate product launches against a 200-plus item control catalog, a self-healing fuzz-testing loop that writes and repairs its own test harnesses, and an autonomous posture-management system that watches production for configuration drift (Google Cloud Blog, June 2026).

Google's stated end goal has a name: "immune" software, applications that continuously discover, validate, and patch their own weaknesses. That's an ambitious framing, and it's worth treating it as exactly that, a framing, not a finished product. What's open source today is the discovery-and-patching core. The rest of the immune-system pitch is Google's internal roadmap, not something you can clone and run tonight.

How You'd Actually Try It

Setup is genuinely simple, almost anticlimactically so:

Clone it: git clone https://github.com/google/mantis.git.
Open your coding agent and ask it to use the Mantis framework in that folder to review your codebase.
Run the skills one at a time with slash commands (/mantis-plan, /mantis-researcher, and so on), approving each step yourself before it executes anything.

But don't skip past the warnings the way a changelog entry usually invites you to. The repo's caution banner isn't boilerplate: it explicitly says not to run this on any machine with access to production systems, sensitive data, or internal networks, and to treat AI-generated code as something that might behave unpredictably. Google's own advice is to start in interactive, human-approved mode, never with auto-approve flags, and to run anything the agent generates inside a sandboxed container with no network access. This project also isn't eligible for Google's own vulnerability rewards program, which tells you something about how Google itself is classifying its maturity.

Why This Actually Matters

I don't think the interesting story here is "Google made a security scanner." Plenty of companies have done that, and most of those tools are forgettable. The interesting story is the honesty embedded in the design: Google built Mantis explicitly because it didn't trust AI's first instinct about what counts as a bug, and instead of hiding that distrust, it built the entire architecture around it, layers of critics, mandatory sandboxed proof, human approval gates by default. That's a different posture than most "AI finds your bugs" pitches, which tend to sell confidence rather than admit the confidence has to be earned.

That doesn't mean Mantis is a finished answer. It's a demonstration, by Google's own label, aimed at a problem Google's own numbers show is real: AI-driven attacks are getting faster, and most AI-driven defenses aren't good enough yet to keep up. Mantis is one credible attempt to close that gap, not a guarantee that it's closed.