Google has open-sourced Mantis, an AI-agent framework designed to automate the software vulnerability lifecycle from identification through validation to repair. The tool targets a specific failure mode in existing AI-powered code scanning: high false positive rates and hallucinated vulnerabilities that waste developer time and erode trust in automated security tools. Google says its internal data shows some AI scanning approaches produce true-positive rates under 7%, making them more noise than signal for engineering teams.

Why brute-force scanning fails

Conventional AI code scanners typically examine files one at a time without understanding how they relate to each other. This blind approach produces explanations that sound plausible but lack grounding in the actual codebase. Mantis takes a different path: it analyzes repository history, previous security fixes, architecture, and threat models before scanning anything. It then summarizes the analyzed files into a hierarchical tree containing directory- and repository-level context, reducing token usage by 85% while retaining the structural information needed to reason about real vulnerabilities.

The token reduction matters because vulnerability scanning is a volume problem. A large repository might contain thousands of files, and sending all of them through an LLM is both expensive and slow. By summarizing the codebase into a context tree first, Mantis can focus its analysis on the parts of the code that are most likely to contain issues, without losing the relationships between files that often reveal the actual attack surface.

Agentic techniques for grounding

Mantis uses a pipeline of specialized agents rather than a single monolithic scanner. A strategist agent evaluates high-level code structure, threat models, and dependency graphs. Research agents use internal code searches to examine raw source files in depth, tracing data flows, control flows, and sanitization logic. Critic and reviewer agents filter out false positives and prioritize meaningful findings. This layered approach means each agent focuses on what it does well, rather than asking one model to handle everything from architecture review to line-by-line code analysis.

The critic and reviewer agents are the key to reducing false positives. Instead of relying on the scanning model's own judgment about what constitutes a real vulnerability, separate agents evaluate whether the finding is supported by evidence in the codebase. This mirrors how human security reviews work: one person finds potential issues, another reviews whether they are real.

When a finding survives the review process, Mantis can reproduce it in a sandboxed environment. This is a critical step that most automated scanners skip. Rather than trusting the LLM's claim that a vulnerability exists, Mantis generates a functional crash reproducer and runs it in isolation. The finding is either confirmed by the reproducer or discarded. This grounds the entire pipeline in observable behavior rather than model confidence.

Modular tool suite with model flexibility

Mantis is organized as a modular skill suite of over 15 tools that can run sequentially or in parallel. Tools include mantis-summarize, mantis-review, mantis-critic, mantis-researcher, mantis-dedupe, mantis-reproduce, and mantis-patch, among others. The stages communicate by reading and writing to a shared state stored on disk, which means each tool can be tested and debugged independently.

The framework supports multiple models and pairs different model classes with different phases. Google recommends using lightweight models for tasks that do not require deep reasoning, such as rapid classification or deduplication of similar text patterns. More powerful models handle tasks requiring contextual understanding and zero-shot problem solving, like writing functional crash reproducers or generating side-effect-free code patches. This pragmatic approach to model selection keeps costs down while reserving expensive inference for the tasks that need it.

The false-positive problem

Every vulnerability scanning system produces false positives, sometimes in frustrating volume. Mantis addresses this with mantis-review, which applies a rule-based negative filter to eliminate likely false positives. But Google warns against making the filter too broad. Low-risk findings should not automatically be classified as false positives, because an overly aggressive negative filter could miss genuine vulnerabilities that happen to look routine. The filter is a tool, not a policy.

This tension is familiar to anyone who has worked with automated security scanners. Too few false positives means the filter is too aggressive and real issues slip through. Too many means developers stop trusting the output. Mantis tries to find the middle ground by combining deterministic filtering with agentic review, rather than relying on either approach alone.

Available on GitHub

Mantis is available on GitHub with a detailed agent reference guide covering all available stages, inter-stage contracts, and best practices. The framework is part of Google's internal approach to finding and fixing vulnerabilities at machine speed, and the open-source release makes the same pipeline available to any organization willing to run it. For teams dealing with the false-positive fatigue of existing AI scanning tools, Mantis represents a different architecture: one that grounds its findings in evidence and reproduction rather than model confidence alone.