Google Mantis: Open-Source AI Harness to Find and Fix Bugs

Google has open-sourced Mantis, an AI-powered harness designed to automate the discovery, triage, reproduction, and patching of software vulnerabilities. Announced on the Google Cloud blog and published as a modular toolkit on GitHub, Mantis is part of Google’s internal approach to finding and fixing bugs at machine speed.

The core idea is simple but significant: instead of treating AI code scanning as another source of noisy alerts, Mantis builds a full agentic pipeline that grounds findings in evidence. Vulnerabilities are reproduced in sandboxed environments, filtered by critic and review agents, and patched with fixes verified against a working crash reproducer.

Why Mantis matters

AI code scanning frequently produces hallucinated bugs and weak true-positive rates. Google notes that sloppiness in AI-driven scanning often leads to true-positive rates below 7%, which buries security teams under noise.

Mantis attacks that problem with a multi-stage, evidence-driven design:

• Repository history analysis: It examines a repository’s commit history to learn from past security fixes.
• Automatic documentation: It builds architectural summaries and a living threat model, even when none is provided.
• Structural summarization: A hierarchical summary tree condenses files into directory- and root-level summaries, reducing token overhead by more than 85% while preserving structural context across large repositories.
• Sandboxed reproduction: Candidate vulnerabilities are validated by executing crash reproducers in isolated containers with networking disabled.

The result is fewer hallucinated findings and patches that have to demonstrate their value before reaching a human reviewer.

This matters because AI has already accelerated the offensive side. As covered in how AI weaponizes vulnerabilities in minutes, attackers now exploit flaws far faster than traditional remediation workflows allow. Mantis is a defensive answer to that time collapse.

How the Mantis pipeline works

Mantis is a set of portable “skills” for AI coding agents, usable with Gemini CLI, Antigravity CLI, or any compatible coding agent framework. Each skill is a discrete pipeline stage invoked as a slash command:

/mantis-history      → learn from past security fixes in VCS history
/mantis-structural-index → build a semantic-unit index of the codebase
/mantis-summarize    → generate directory maps
/mantis-architecture → synthesize a Markdown Knowledge Base
/mantis-threat-model → iteratively develop the project's threat model
/mantis-plan         → map external boundaries and build a scan roadmap
/mantis-researcher   → run the security flaw sweep
/mantis-dedupe       → consolidate overlapping and duplicate findings
/mantis-review       → verify code validity and filter false positives
/mantis-critic       → eliminate non-viable production issues
/mantis-reproduce    → generate crash reproducers and run them in sandboxes
/mantis-chain        → combine findings into multi-step exploit chains
/mantis-patch        → apply minimal fixes and verify against reproducers
/mantis-calibrate    → calculate final risk ratings
/mantis-reflect      → extract learnings for future passes
/mantis-report       → generate the human-readable review packet

The evidence loop

The stages that make Mantis distinct are the middle ones. Rather than reporting every suspicious pattern:

1. Review applies negative rules to filter likely false positives.
2. Critic removes findings that are technically valid but not viable in production.
3. Reproduce writes a proof-of-concept crash and executes it in a sandbox with networking disabled.
4. Chain combines validated findings into realistic multi-step exploits.
5. Patch applies a minimal fix and re-runs the reproducer to confirm the fix blocks the crash.

A patch is only considered credible when it demonstrably prevents the reproducer from crashing. That grounding requirement is what separates Mantis from most AI SAST tooling.

Getting started with Mantis

The quickstart from the Google Cloud blog:

git clone https://github.com/google/mantis.git

Then open your coding agent and use a prompt such as:

I would like to use the Mantis framework in path/to/mantis to review my code
in path/to/your/code. Can you help me get started?

Google states this exact prompt has been used internally to find real vulnerabilities across its repositories. The repository includes sample sandboxing options, and you can implement your own sandbox to match your workflow.

Practical safety requirements

Mantis generates and executes AI-produced code, so isolation is mandatory:

• Never run it on a host with access to production systems, sensitive data, or internal networks. Google’s own guidance recommends a dedicated, isolated VM.
• Run AI-generated crash reproducers inside containers with networking disabled, for example by registering Docker’s runsc (gVisor) runtime with --network=none.
• Start in interactive mode. Run the slash commands individually and require human approval before /mantis-reproduce or /mantis-patch write files or execute code. Avoid full auto-approval flags.
• Expect false positives. Tune the negative filters in /mantis-review for your codebase, and start with narrow-scope scans rather than a repository-wide sweep on day one.
• Pair models to stages. Use lightweight models for cheap stages like summarization and reserve frontier models for reasoning-heavy stages like threat modeling and exploit chaining.

The project is Apache 2.0 licensed and explicitly labeled a demonstration project, not an officially supported Google product.

Securing the harness itself

Mantis is also a case study in agentic AI security. An AI system that can read code, run payloads, and write patches introduces its own attack surface:

• A malicious file in the target repository could attempt prompt injection against the researcher or patch agents.
• Auto-generated SKILL.md prompt files must be human-gated so an attacker cannot trick the meta-agent into globally ignoring a vulnerability class.
• Unattended deployments require a hardened environment, which is why the project documents a dedicated hardening guide for Google Compute Engine.

These risks mirror the concerns in OWASP’s agentic AI work. The OWASP OASIS project addresses the same validation gap from the open-source community side: AI-generated fixes are only trustworthy when a validation layer stands between generation and acceptance.

Mantis, OASIS, and the future of automated remediation

Mantis and OWASP OASIS represent the same trend from different angles: closing the gap between finding vulnerabilities and fixing them.

• Mantis gives individual teams an end-to-end harness: discover, reproduce, patch, and verify with evidence.
• OASIS organizes AppSec professionals into a community validation layer for AI-generated fixes across open source.
• Commercial platforms such as Endor Labs’ AI remediation agents are building the same capability for enterprise dependency management.

The common denominator is evidence. Reproducers, sandbox validation, and human review turn AI output from a hypothesis into a credible patch.

The bottom line

Google Mantis makes the defensive pipeline visible and reusable: clone the repository, point your coding agent at it, and run a staged review that ends with verified patches rather than another alert queue. It is not a turnkey production tool, and Google is explicit about that. It is a starting point you are expected to adapt, sandbox, and tune.

For teams drowning in low-fidelity scanner output, that combination of reproducible evidence and patch verification is the part worth copying, regardless of which harness you run.

To further enhance your cloud security and harden your CI/CD pipelines, contact me on LinkedIn Profile or mail.

Frequently Asked Questions (FAQ)

What is Google Mantis?

Mantis is an open-source AI harness from Google that automates vulnerability discovery, triage, reproduction, and patching. It is a modular set of skills for AI coding agents, available on GitHub under the Apache 2.0 license.

How does the Mantis harness find bugs?

Mantis analyzes repository history, builds architectural and threat-model documentation, then runs a staged pipeline: researcher agents scan for flaws, review and critic agents filter false positives, and reproduce agents generate sandboxed crash reproducers to ground each finding in evidence.

How is Mantis different from traditional SAST tools?

Traditional SAST produces pattern-based alerts with high false-positive rates. Mantis validates each candidate finding by executing a proof-of-concept crash reproducer in an isolated sandbox and only accepts patches that demonstrably block the reproducer.

Which AI coding agents work with Mantis?

Mantis is platform agnostic. Google has used it with Gemini CLI and Antigravity CLI, and states any coding agent framework should work, including integrations built on the Google ADK and Antigravity SDK.

Is Mantis safe to run on my own machine?

Mantis executes AI-generated code, so Google strongly recommends running it only in isolated environments such as a dedicated VM, with crash reproducers executed in containers using network-disabled runtimes like gVisor. Never run it on a host with access to production systems or sensitive data.

Can Mantis automatically patch vulnerabilities?

Yes. The mantis-patch skill applies minimal fixes and verifies each one by re-running the crash reproducer. However, findings and patches are intended for expert review, and the project explicitly warns against mass-filing unverified AI-generated reports.

Resources

• Mantis on GitHub: github.com/google/mantis
• Google Cloud announcement: Getting started with Mantis
• Google Secure AI Framework (SAIF): safety.google/safety/saif

Mantis is a demonstration project and is not an officially supported Google product. All findings should be verified by security experts before being reported or acted upon.