Google Mantis: An Agentic Vulnerability Scanning Harness for Reducing

What happened

Google has open-sourced Mantis, an AI-agent framework built to automate the full software vulnerability lifecycle, from initial detection through validation, reproduction, and fix generation. The release follows an acknowledgment from Google that conventional AI-powered code scanners routinely produce false positives and hallucinated vulnerabilities that waste engineering time and erode trust in automated tooling.

This piece is for security engineers, platform teams, and developers who rely on automated scanning in their pipelines. It explains what Mantis is, how its agentic approach differs from prior AI scanning tools, what teams should verify before adopting it, and what the release does not yet answer.

Google released Mantis as an open-source project under its own name. The framework is described as an agentic harness, meaning it coordinates AI agents across discrete phases of vulnerability work rather than running a single model pass over source code. Google's stated motivation is direct: existing AI scanning tools generate too many false positives and can hallucinate vulnerabilities that do not exist in the code under review. Mantis is Google's attempt to address both problems by building a feedback loop that validates and reproduces findings before surfacing them.

How it works

The release was reported by InfoQ, which characterized Mantis as covering the full vulnerability lifecycle. Google positioned it as a framework rather than a finished product, which means teams integrating it will need to supply their own underlying models, execution environments, and pipeline wiring. The open-source availability means the code can be inspected, forked, and extended, though it also means Google has not committed to an enterprise support tier through this release.

The teams most directly affected are those already running AI-assisted code analysis in CI pipelines or security review workflows. Any organization relying on tools that use large language models to flag vulnerabilities without a validation step is operating in the environment Mantis was designed to improve. Google's framing implies that false-positive noise is widespread enough across the industry to justify building a dedicated orchestration layer rather than patching existing scanners.

Why it matters

Developers maintaining open-source repositories under automated security scanning programs, such as those run by major platforms and bug bounty organizations, are also relevant here. If Mantis reduces the volume of unverified findings that reach human reviewers, it changes the economics of triage. Teams that have tuned their workflows around high false-positive rates will need to reassess their processes when agentic validation layers become standard.

If your team uses any AI-powered static analysis tool, the immediate action is to audit your current false-positive rate. Mantis gives you a concrete benchmark to argue against: Google explicitly built this because the hallucination and false-positive problem was material enough to warrant a new framework. Document how many AI-flagged findings your team triages per sprint and how many result in real patches. That baseline will help you evaluate whether integrating Mantis or a similar validation layer produces measurable triage savings.

For teams considering adopting Mantis directly, the first step is reviewing the open-source repository to understand which models and execution environments it supports and what integrations it requires. Because Google released this as a framework rather than a packaged tool, you will need to assess the engineering lift required to wire it into an existing pipeline. Run it in a shadow mode against a known codebase before routing live alerts through it.

Who is affected

AI code scanners that rely on language models to identify vulnerabilities face a structural problem: the models are trained to recognize patterns associated with vulnerability classes, but pattern recognition alone cannot confirm that a vulnerability is actually reachable or exploitable in a given codebase. A model may flag a code path that resembles a known injection pattern without verifying that the path is actually reachable from user-controlled input. The result is a finding that is syntactically plausible but semantically incorrect, which is the definition of a false positive.

Mantis addresses this by adding agentic validation and reproduction steps after initial detection. Rather than stopping at flagging, the framework attempts to reproduce the vulnerability in a controlled environment and confirms whether the finding holds before escalating it. This reduces the signal-to-noise problem at the source rather than asking human reviewers to filter it downstream. The approach reflects a broader shift in AI security tooling toward multi-step reasoning loops rather than single-pass inference.

What to watch next

Google has not disclosed which underlying models Mantis uses by default, whether it supports third-party models, or what hardware or compute requirements the reproduction step demands at scale. The release does not include published benchmarks comparing Mantis false-positive rates against specific competing tools. Without those figures, it is not yet possible to independently verify Google's central claim that the agentic loop meaningfully reduces hallucinated findings compared to conventional scanning approaches.

It is also unclear whether Mantis currently handles the full range of vulnerability classes across multiple programming languages or whether the initial release targets a specific subset. The degree to which the reproduction step requires sandboxed execution infrastructure, and who bears the cost of maintaining that infrastructure in a production deployment, has not been addressed publicly. Those answers will be necessary before most security teams can commit to integrating the framework into a regulated or compliance-sensitive environment.