Autonomous AI Vulnerability Patching Tools Compared (2026): Mantis vs CodeMender vs Aardvark vs XBOW vs AIxCC
The autonomous-AppSec field splits along four axes: find-only vs find+reproduce+patch; open-source vs SaaS; stack-agnostic vs language-specific; and fully autonomous vs human-in-the-loop. Full-loop systems that reproduce a bug and prove the patch fixes it are Google Mantis (open, self-hosted, demo-grade), OpenAI Aardvark (closed GPT-5 beta), and the DARPA AIxCC cyber reasoning systems (open-sourced; the only neutral, apples-to-apples benchmark we have). Finders-not-fixers: Google Big Sleep and OSS-Fuzz-Gen (discovery/fuzzing) and XBOW (offensive pentest, #1 on HackerOne US in 2025). Patch-suggesters bolted onto a scanner: GitHub Copilot Autofix, Semgrep Assistant, Mobb, Pixee, Corgea — best for remediation throughput in CI, not novel discovery. Google DeepMind's CodeMender is the strongest track record among single-vendor agents (72 security fixes upstreamed to open source, each human-reviewed, plus proactive rewrites that remove whole bug classes) but it is closed and research-phase; Mantis is Google's open, self-hostable counterpart. Vendor metrics below are flagged as such; the only rigorous neutral evaluation is AIxCC, where Team Atlanta's ATLANTIS placed first.
In 2026 "autonomous AI that fixes vulnerabilities" stopped being a demo and started being a category — with Google DeepMind's CodeMender upstreaming dozens of security fixes, Google open-sourcing Mantis, OpenAI announcing Aardvark, XBOW topping HackerOne, and DARPA's AI Cyber Challenge proving the full find-and-patch loop can run with no human at all. But the tools are not interchangeable — some find, some fix, some do both and prove it. Here is the map.
The four axes that decide fit
- Find-only vs find + reproduce + patch. The strongest systems reproduce a bug in a sandbox and prove the patch stops the reproducer. That is CodeMender, Mantis, Aardvark, and the AIxCC cyber reasoning systems. Finders (Big Sleep, OSS-Fuzz-Gen) and offensive tools (XBOW) do not patch; scanner-plus-fixers (Copilot Autofix, Semgrep, Mobb, Pixee, Corgea) patch but do not reproduce.
- Open-source vs SaaS. Self-hostable: Mantis, OSS-Fuzz-Gen, the AIxCC systems. Not released: CodeMender, Big Sleep. Commercial: Aardvark, XBOW, Copilot Autofix, Semgrep Assistant, Mobb, Pixee, Corgea.
- Stack-agnostic vs language-specific. Mantis is explicitly stack-agnostic; the AIxCC corpus was C/Java; OSS-Fuzz-Gen is C/C++; the commercial fixers cover the common web-app languages.
- Fully autonomous vs human-in-the-loop. The only systems demonstrated running fully autonomously end-to-end at scale were the AIxCC CRSs in competition conditions. Everything shipped to real users keeps a human gate.
The comparison matrix
| Tool | Maker | OSS / Commercial | Finds | Reproduces | Patches | Best for |
|---|---|---|---|---|---|---|
| Mantis | Google (security eng.) | OSS (Apache-2.0) | Yes | Yes (sandbox) | Yes (adversarial verify) | Self-hosted autonomous audit (demo-grade) |
| OpenAI Aardvark | OpenAI (GPT-5) | Commercial (private beta) | Yes | Yes (sandbox) | Yes (human review) | Managed pipeline-embedded research agent |
| XBOW | XBOW (startup) | Commercial | Yes (offensive) | Yes (deterministic validation) | No | Continuous external pentest |
| AIxCC CRSs (ATLANTIS, Buttercup, Theori) | GT/Samsung, Trail of Bits, Theori | OSS | Yes | Yes | Yes | Fully-autonomous find+patch (benchmarked) |
| Google Big Sleep | Project Zero + DeepMind | Research (not released) | Yes | Partial | No | Novel 0-day discovery / variant analysis |
| OSS-Fuzz-Gen | OSS | Yes (fuzzing) | Yes (crash) | No | LLM-generated fuzz harnesses (C/C++) | |
| Copilot Autofix | GitHub | Commercial (free public repos) | Via CodeQL | No | Yes (suggest) | CI-gate remediation on GitHub |
| Semgrep Assistant | Semgrep | Commercial add-on | Via Semgrep | No | Yes (draft PR) | Autotriage + autofix for Semgrep users |
| Mobb / Pixee / Corgea | Startups | Commercial (some free tiers) | Corgea yes; Mobb/Pixee ingest SAST | No | Yes (PR fixes) | Remediation throughput, developer-approved |
| CodeMender | Google DeepMind (Gemini Deep Think) | Not released (research) | Yes | Validates (analysis, fuzzing, SMT, LLM judge) | Yes + proactive rewrites | Track record: 72 fixes upstreamed to OSS |
Every per-tool performance number advertised by these vendors (Aardvark ~92% detection, Semgrep 96% triage agreement, Pixee 76% merge rate, Copilot ">2/3 remediated", Corgea "90% fewer false positives") is vendor-reported on the vendor's own benchmark and not independently verified. The AIxCC figures are DARPA-run on an identical corpus.
Mantis vs CodeMender: Google's two bets
Google is the only company with two entries here, and they are easy to confuse. CodeMender, announced by Google DeepMind in October 2025, is the closed research agent with the track record: built on Gemini Deep Think, it patches new vulnerabilities at the root cause and proactively rewrites code to remove whole bug classes — DeepMind's showcase was adding -fbounds-safety annotations to libwebp, the library behind CVE-2023-4863, which it says would have made that class of buffer overflow unexploitable. Each patch passes static and dynamic analysis, differential testing, fuzzing and SMT checks plus an LLM-judge critique before a human reviews it; DeepMind reported 72 security fixes upstreamed to open-source projects, some over 4.5 million lines. It is not publicly available yet — DeepMind says it is working with maintainers first and hopes to release it once reliability is proven.
Mantis, open-sourced by Google security engineering in September 2026, is the inverse trade-off: Apache-2.0, runnable today in your own sandbox, the same reproduce-patch-verify philosophy — but demonstration-grade, with no published results. If you want to see what Google's approach achieves, look at CodeMender's upstreamed fixes; if you want to use a version of it, Mantis is the one you can actually download.
Which is better — the honest verdict
- If you want proof the full loop works: look at AIxCC. It is the only neutral, apples-to-apples evaluation — identical code to every system, DARPA-run. In the August 2025 final the systems collectively found 54 synthetic vulnerabilities and patched 43, plus 18 real-world bugs. Team Atlanta's ATLANTIS placed first, Trail of Bits' Buttercup second, Theori third — all open-sourced. That is your credible "it actually works" anchor.
- If you want the strongest single-vendor track record: CodeMender — 72 human-reviewed fixes upstreamed to real open-source projects plus proactive bug-class elimination. You cannot use it yet; watch for DeepMind's maintainer program.
- If you want an open framework to run today: Mantis — closest open analog to the AIxCC approach, with reproduce-and-verify, self-hosted so source stays in-house. Caveat: demo-grade, no benchmark, expert-verify mandatory.
- If you want a managed product and can get beta access: OpenAI Aardvark — pipeline-embedded, GPT-5, closed beta, vendor numbers only.
- If your problem is external attack surface: XBOW — proven on HackerOne (first AI to #1 on the US leaderboard in 2025), but it finds and exploits; it does not fix.
- If you want novel 0-days / fuzzing R&D: Big Sleep (found an exploitable SQLite 0-day in 2024) and OSS-Fuzz-Gen (open, C/C++; its AI-generated harnesses found OpenSSL CVE-2024-9143).
- If you just want fewer vulns shipping through CI: Copilot Autofix (if on GitHub/CodeQL), Semgrep Assistant (if on Semgrep), or a standalone fixer like Mobb / Pixee / Corgea. Least new infrastructure, best remediation throughput — just don't expect them to discover novel bugs.
How to choose, in one pass
- Do you need discovery or remediation? Discovery of novel bugs → Mantis / Aardvark / AIxCC systems / Big Sleep. Faster fixing of already-found issues → Copilot Autofix / Semgrep / Mobb / Pixee / Corgea.
- Can your source leave your environment? No → Mantis or the AIxCC systems (self-hosted). Yes → the SaaS options open up.
- What language is the code? C/C++ heavy → OSS-Fuzz-Gen and the AIxCC lineage are proven there. Web-app languages → the commercial fixers and Corgea.
- Do you have a security expert to verify output? If not, stay with human-in-the-loop PR-suggestion tools; the autonomous auditors assume an expert reviews every finding.
- Before any of it, do you have a threat model? An autonomous agent is far more useful when it knows the trust boundaries it is defending. Build one first.
Whichever you pick, the pattern is the same: let the machine do the tireless search-and-reproduce, keep a human on the verdict, and never auto-file an unverified AI finding. The tools that win are the ones that prove their own work — reproduce the bug, patch it, and show the bug is gone.
Frequently asked questions
Which autonomous vulnerability tool is best?
It depends on the job, and the only neutral evidence is DARPA's AI Cyber Challenge (AIxCC), where identical code was given to every system. There, Team Atlanta's ATLANTIS placed first, Trail of Bits' Buttercup second, and Theori third — all now open-sourced. Among single-vendor agents, Google DeepMind's CodeMender has the strongest public track record (72 security fixes upstreamed to open source) but is not publicly available. For a self-hostable open framework you can run today, Google Mantis is the closest analog to those systems (it has the reproduce-and-verify loop) but ships as "demonstration only" with no benchmark. For a managed closed product, OpenAI's Aardvark is the nearest commercial equivalent but is in private beta with only vendor-reported numbers. For CI-gate remediation on an existing scanner, GitHub Copilot Autofix, Semgrep Assistant, Corgea, Mobb or Pixee fit with the least new infrastructure. Every vendor performance figure should be treated as marketing until independently verified.
What is Google DeepMind CodeMender and how does it compare?
CodeMender is a code-security agent Google DeepMind announced in October 2025, built on Gemini Deep Think. It works two ways: reactively, it patches newly found vulnerabilities by addressing the root cause; proactively, it rewrites existing code to remove whole classes of vulnerabilities, for example applying -fbounds-safety annotations to libwebp (the library behind CVE-2023-4863). It combines static and dynamic analysis, differential testing, fuzzing and SMT solvers, and runs an LLM-judge critique step that checks each patch for correctness and regressions before a human reviews it. DeepMind reported 72 security fixes upstreamed to open-source projects, some exceeding 4.5 million lines of code. It is still research-phase and not publicly available. Compared with Google Mantis, CodeMender has the track record but is closed; Mantis is open and self-hostable but demonstration-grade with no published results.
What is the difference between finding, reproducing, and patching?
Finding is flagging a suspected vulnerability. Reproducing is proving it is real by writing a proof-of-concept and triggering the bug (usually a crash) in a sandbox — this is what cuts false positives. Patching is generating a fix; the strongest systems then re-run the reproducer to confirm the crash is gone (an adversarial fix-verification loop). Most commercial tools find-and-suggest-fixes but skip reproduction; the full-loop systems (Mantis, Aardvark, the AIxCC CRSs) reproduce and verify, which is why their fixes are more trustworthy — and why they cost more compute.
Which of these are open-source?
Open and self-hostable: Google Mantis (Apache-2.0), OSS-Fuzz-Gen, and all seven DARPA AIxCC finalist cyber reasoning systems (released under OSI-approved licences, including Team Atlanta's ATLANTIS and Trail of Bits' Buttercup). Not publicly released: Google DeepMind CodeMender and Google Big Sleep (research). Commercial/SaaS: OpenAI Aardvark (private beta), XBOW, GitHub Copilot Autofix (free on public repos), Semgrep Assistant, Mobb, Pixee, and Corgea. If keeping source in-house is a hard requirement, Mantis (run in your own sandbox) and the AIxCC systems are the standouts.
Can I trust the accuracy numbers these tools advertise?
Treat them as vendor marketing unless independently verified. Aardvark's ~92% detection, Semgrep Assistant's 96% triage agreement, Pixee's 76% merge rate, Copilot Autofix's ">2/3 remediated", Corgea's "90% fewer false positives" — all are vendor-reported on their own benchmarks. The single exception with rigorous, neutral, apples-to-apples evaluation is DARPA's AIxCC, where every cyber reasoning system ran against the same corpus under the same rules; in the August 2025 final the systems collectively found 54 synthetic vulnerabilities and patched 43, and discovered 18 real-world vulnerabilities. That is your most defensible anchor for "which autonomous find+patch system actually works."
I just want to reduce vulnerabilities in my CI pipeline — what should I use?
If you are already on GitHub Advanced Security / CodeQL, turn on Copilot Autofix (free on public repos) — it adds AI fix suggestions to existing findings with no new tooling. If you run Semgrep, add Semgrep Assistant for autotriage and autofix PRs. If you want a standalone AI fixer that ingests a scanner's findings, look at Mobb, Pixee or Corgea. These are remediation-throughput tools: they make fixing faster, they do not hunt for novel bugs. For deep autonomous auditing of a whole codebase, that is where Mantis or (with beta access) Aardvark come in — and you should pair either with a threat model so the agent knows what it is defending.
Ready to practise the decisions these articles describe?
Run a free War Room →