Google Open-Sources 'Mantis', an AI-Based Tool for Automated Vulnerability Detection and Patching

Google has released Mantis, an open-source framework that leverages AI models to automate the discovery, classification, reproduction, and patching of software vulnerabilities. This technology was previously used internally at Google to process vulnerabilities at machine speed, providing efficient and context-aware analysis for vast code repositories.

Technical Features and Performance

Existing AI code scanning often suffered from high false-positive rates due to hallucinations, with true-positive rates frequently below 7%. Mantis addresses this by applying standard agent techniques such as critic and review agents and validating results through sandbox reproduction of vulnerabilities. It also learns from the repository's past security fix history to automatically build architecture and threat model documentation.

In particular, it constructs a hierarchical security summary tree that compresses file-level data into directory and root-level summaries, reducing token overhead by more than 85% while maintaining critical structural context even in large repositories.

Usage

Mantis is available for download on GitHub and can be integrated with coding agents. When a user prompts it to review code in a specific path, it operates in the same manner used internally at Google to discover actual vulnerabilities. The repository includes sample sandbox options, allowing for implementation tailored to user workflows.