# Autonomous AI Vulnerability Patching Tools Compared (2026): Mantis vs CodeMender vs Aardvark vs XBOW vs AIxCC

> A sourced comparison of the autonomous AI tools that find and/or patch vulnerabilities in 2026 — Google Mantis, OpenAI Aardvark, XBOW, the DARPA AIxCC cyber reasoning systems, GitHub Copilot Autofix, Semgrep Assistant, Mobb, Pixee, Corgea, OSS-Fuzz-Gen — plus Google DeepMind CodeMender: what each does, which is better for what, and how Google's two efforts differ.

Source: https://playciso.com/blog/autonomous-ai-vulnerability-patching-tools-compared · Published: 2026-10-27 · Publisher: PlayCISO (https://playciso.com)

---

In 2026 "autonomous AI that fixes vulnerabilities" stopped being a demo and started being a category — with Google DeepMind's CodeMender upstreaming dozens of security fixes, Google open-sourcing [Mantis](/blog/google-mantis-autonomous-vulnerability-patching), OpenAI announcing Aardvark, XBOW topping HackerOne, and DARPA's AI Cyber Challenge proving the full find-and-patch loop can run with no human at all. But the tools are not interchangeable — some find, some fix, some do both and prove it. Here is the map. ## The four axes that decide fit - Find-only vs find + reproduce + patch. The strongest systems reproduce a bug in a sandbox and prove the patch stops the reproducer. That is CodeMender, Mantis, Aardvark, and the AIxCC cyber reasoning systems. Finders (Big Sleep, OSS-Fuzz-Gen) and offensive tools (XBOW) do not patch; scanner-plus-fixers (Copilot Autofix, Semgrep, Mobb, Pixee, Corgea) patch but do not reproduce. - Open-source vs SaaS. Self-hostable: Mantis, OSS-Fuzz-Gen, the AIxCC systems. Not released: CodeMender, Big Sleep. Commercial: Aardvark, XBOW, Copilot Autofix, Semgrep Assistant, Mobb, Pixee, Corgea. - Stack-agnostic vs language-specific. Mantis is explicitly stack-agnostic; the AIxCC corpus was C/Java; OSS-Fuzz-Gen is C/C++; the commercial fixers cover the common web-app languages. - Fully autonomous vs human-in-the-loop. The only systems demonstrated running fully autonomously end-to-end at scale were the AIxCC CRSs in competition conditions. Everything shipped to real users keeps a human gate. ## The comparison matrix ToolMakerOSS / CommercialFindsReproducesPatchesBest for **Mantis**Google (security eng.)OSS (Apache-2.0)YesYes (sandbox)Yes (adversarial verify)Self-hosted autonomous audit (demo-grade) **OpenAI Aardvark**OpenAI (GPT-5)Commercial (private beta)YesYes (sandbox)Yes (human review)Managed pipeline-embedded research agent **XBOW**XBOW (startup)CommercialYes (offensive)Yes (deterministic validation)NoContinuous external pentest **AIxCC CRSs** (ATLANTIS, Buttercup, Theori)GT/Samsung, Trail of Bits, TheoriOSSYesYesYesFully-autonomous find+patch (benchmarked) **Google Big Sleep**Project Zero + DeepMindResearch (not released)YesPartialNoNovel 0-day discovery / variant analysis **OSS-Fuzz-Gen**GoogleOSSYes (fuzzing)Yes (crash)NoLLM-generated fuzz harnesses (C/C++) **Copilot Autofix**GitHubCommercial (free public repos)Via CodeQLNoYes (suggest)CI-gate remediation on GitHub **Semgrep Assistant**SemgrepCommercial add-onVia SemgrepNoYes (draft PR)Autotriage + autofix for Semgrep users **Mobb / Pixee / Corgea**StartupsCommercial (some free tiers)Corgea yes; Mobb/Pixee ingest SASTNoYes (PR fixes)Remediation throughput, developer-approved **CodeMender**Google DeepMind (Gemini Deep Think)Not released (research)YesValidates (analysis, fuzzing, SMT, LLM judge)Yes + proactive rewritesTrack record: 72 fixes upstreamed to OSS Every per-tool performance number advertised by these vendors (Aardvark ~92% detection, Semgrep 96% triage agreement, Pixee 76% merge rate, Copilot ">2/3 remediated", Corgea "90% fewer false positives") is vendor-reported on the vendor's own benchmark and not independently verified. The AIxCC figures are DARPA-run on an identical corpus. ## Mantis vs CodeMender: Google's two bets Google is the only company with two entries here, and they are easy to confuse. **CodeMender**, announced by Google DeepMind in October 2025, is the closed research agent with the track record: built on Gemini Deep Think, it patches new vulnerabilities at the root cause _and_ proactively rewrites code to remove whole bug classes — DeepMind's showcase was adding `-fbounds-safety` annotations to libwebp, the library behind CVE-2023-4863, which it says would have made that class of buffer overflow unexploitable. Each patch passes static and dynamic analysis, differential testing, fuzzing and SMT checks plus an LLM-judge critique before a human reviews it; DeepMind reported **72 security fixes upstreamed** to open-source projects, some over 4.5 million lines. It is not publicly available yet — DeepMind says it is working with maintainers first and hopes to release it once reliability is proven. **Mantis**, open-sourced by Google security engineering in September 2026, is the inverse trade-off: Apache-2.0, runnable today in your own sandbox, the same reproduce-patch-verify philosophy — but demonstration-grade, with no published results. If you want to see what Google's approach _achieves_, look at CodeMender's upstreamed fixes; if you want to _use_ a version of it, Mantis is the one you can actually download. ## Which is better — the honest verdict - If you want proof the full loop works: look at AIxCC. It is the only neutral, apples-to-apples evaluation — identical code to every system, DARPA-run. In the August 2025 final the systems collectively found 54 synthetic vulnerabilities and patched 43, plus 18 real-world bugs. Team Atlanta's ATLANTIS placed first, Trail of Bits' Buttercup second, Theori third — all open-sourced. That is your credible "it actually works" anchor. - If you want the strongest single-vendor track record: CodeMender — 72 human-reviewed fixes upstreamed to real open-source projects plus proactive bug-class elimination. You cannot use it yet; watch for DeepMind's maintainer program. - If you want an open framework to run today: Mantis — closest open analog to the AIxCC approach, with reproduce-and-verify, self-hosted so source stays in-house. Caveat: demo-grade, no benchmark, expert-verify mandatory. - If you want a managed product and can get beta access: OpenAI Aardvark — pipeline-embedded, GPT-5, closed beta, vendor numbers only. - If your problem is external attack surface: XBOW — proven on HackerOne (first AI to #1 on the US leaderboard in 2025), but it finds and exploits; it does not fix. - If you want novel 0-days / fuzzing R&D: Big Sleep (found an exploitable SQLite 0-day in 2024) and OSS-Fuzz-Gen (open, C/C++; its AI-generated harnesses found OpenSSL CVE-2024-9143). - If you just want fewer vulns shipping through CI: Copilot Autofix (if on GitHub/CodeQL), Semgrep Assistant (if on Semgrep), or a standalone fixer like Mobb / Pixee / Corgea. Least new infrastructure, best remediation throughput — just don't expect them to discover novel bugs. ## How to choose, in one pass - Do you need discovery or remediation? Discovery of novel bugs → Mantis / Aardvark / AIxCC systems / Big Sleep. Faster fixing of already-found issues → Copilot Autofix / Semgrep / Mobb / Pixee / Corgea. - Can your source leave your environment? No → Mantis or the AIxCC systems (self-hosted). Yes → the SaaS options open up. - What language is the code? C/C++ heavy → OSS-Fuzz-Gen and the AIxCC lineage are proven there. Web-app languages → the commercial fixers and Corgea. - Do you have a security expert to verify output? If not, stay with human-in-the-loop PR-suggestion tools; the autonomous auditors assume an expert reviews every finding. - Before any of it, do you have a threat model? An autonomous agent is far more useful when it knows the trust boundaries it is defending. Build one first. Whichever you pick, the pattern is the same: let the machine do the tireless search-and-reproduce, keep a human on the verdict, and never auto-file an unverified AI finding. The tools that win are the ones that prove their own work — reproduce the bug, patch it, and show the bug is gone.