Google Open-Sources Mantis, an AI Harness for Finding and Patching Vulnerabilities

Google has open-sourced Mantis, a modular toolkit and Agent Development Kit reference harness for using AI coding agents to find, reproduce, calibrate, chain, and patch software vulnerabilities. Google says related internal agentic methods scan code across its infrastructure and prevent hundreds of vulnerabilities per month from reaching its codebase or production.

The opportunity is not a push-button replacement for application security. Mantis gives engineering and security teams a concrete orchestration pattern they can adapt to their own stacks, threat models, coding standards, and build systems. Its repository also says the project is a demonstration, is not an officially supported Google product, and must not be run against production systems, sensitive data, or internal networks.

Mantis is organized as portable agent skills rather than one fixed scanner. Its workflow can build a threat model, inspect code, try to reproduce suspected vulnerabilities, calibrate severity against a rubric, search for multi-step exploit chains, propose a patch, and use an adversarial loop to check whether the patch actually closes the issue.

The reference harness makes critical steps programmatic. Google's documentation argues that deterministic orchestration can require critic stages, enforce sandboxing, and keep an agent from bypassing controls it might otherwise forget. The design can supplement established static tools rather than pretending probabilistic reasoning should replace them.

Traditional scanners are strongest where a known pattern, dependency, secret, or configuration rule can be expressed deterministically. An agent can add value by following data and control flow, reasoning about application-specific authorization, combining individually modest weaknesses, and adapting a review to internal architecture and historical incidents.

For smaller security teams, the open toolkit can serve as a reference implementation for repeatable deep reviews. Larger organizations can use the skills as a starting point for domain-specific variants covering infrastructure as code, firmware, hardware descriptions, or machine-learning pipelines. Findings can also feed secure-development guidance so later code does not repeat a known failure pattern.

Google's reported internal prevention rate is not an independent benchmark and does not predict results in another codebase. The public toolkit, model, sandbox, documentation, build system, and reviewer expertise may differ materially from Google's internal environment. A reproduced crash does not necessarily establish exploitability, and failure to reproduce does not prove a finding is false.

Mantis can also create risk. It executes generated code, investigates exploit paths, and can propose incorrect fixes. The repository warns that models are non-deterministic, may hallucinate findings, and must not be used to mass-file unverified reports. Human security review remains mandatory.

Start with a disposable, network-isolated copy of a deliberately vulnerable training application—never a production checkout or a machine holding credentials. Remove secrets, disable outbound network access, restrict filesystem and process permissions, cap time and spend, and log every tool call and generated artifact.

Create a labeled evaluation set with known vulnerabilities, safe files, authorization flaws, dependency issues, and multi-step cases. Measure recall, false-positive rate, reproducibility, severity calibration, unsafe commands, patch correctness, regression-test results, reviewer time, and cost per accepted finding. Require two-person approval before reporting a vulnerability or merging a patch.

Security leaders can study Mantis as an architecture, then decide which stages belong beside their existing SAST, dependency, secret, and infrastructure scanners. The best near-term use is a supervised second layer for prioritizing and investigating findings—not autonomous production remediation. If the harness cannot be strongly isolated and observed, it should not be run.

This is a research-based news analysis of Google's engineering post and public repository. DiscoverAI has not executed Mantis, audited its code, or validated Google's internal results. The toolkit is evolving and its documentation, models, and safety boundaries can change.