Google Mantis: An Open-Source Toolkit for AI Agents That Find, Reproduce, and Patch Bugs

On September 2, 2026, Google open-sourced Mantis at github.com/google/mantis under the Apache-2.0 licence. The repository's one-line description is the sentence that caught everyone's eye:

"A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities."

That is the ambition the whole autonomous-AppSec field has been circling. Here is what Mantis actually is, how its find → reproduce → patch loop works, how to run it, and the caveats Google itself flags.

What Mantis is (and is not)

A naming nuance worth getting right: the "autonomously find, reproduce, and patch" line is the repo's GitHub About blurb that Google set. The README's own heading is "Mantis: Portable Toolkit for Building Secure Software," and it describes Mantis as "a set of skills along with an ADK reference harness for building secure software." Both framings are real; the toolkit spans proactive secure-coding help and reactive find-and-fix.

Two disclaimers are load-bearing and belong in any honest write-up. The README states: "This is not an officially supported Google product" and "This project is intended for demonstration purposes only. It is not intended for use in a production environment." So it sits under the official google org and reflects Google's internal find-and-fix approach (per the Google Cloud Security blog, by security engineers Nick Galloway and Yulong Zhang) — but it is a demonstration framework to build on, not a supported product, and not a model release.

The three pieces

• skills/ — the method. The security workflow expressed as agent skills: threat modelling, research, review, patching, and reporting. A mantis-advise skill feeds accumulated knowledge back so agents "write secure code the first time."
• reference/ — the harness. An ADK (Agent Development Kit) reference harness that runs the method as a pipeline, built around Vertex AI and "frontier models" (the README does not pin a specific model).
• action/ — the GitHub Action. Runs the harness over pull requests. Note: the README calls this PR scan "untested" and warns it should not gate merges.

How the loop works

What separates Mantis from a scanner-plus-fix-suggester is that it attempts the entire loop and verifies its own work:

1. Learn the codebase. It reviews repo history to learn from past security fixes, auto-builds architecture and threat-model docs even when none exist, and builds a semantic index.
2. Hypothesise and triage. It generates research hypotheses about where bugs might be, then uses critic and reviewer agents to dedupe and triage them — the explicit goal is cutting false positives before a human ever sees them.
3. Reproduce in a sandbox. For a surviving candidate it attempts to write a proof-of-concept and run it with networking disabled, looking to actually trigger the crash — and to chain vulnerabilities where possible.
4. Patch and prove the fix. It patches, then runs "an adversarial loop to verify the vulnerability is really fixed." A patch counts only if the demonstrated reproducer no longer fires.

Google also describes a scaling trick: Mantis "constructs a hierarchical security summary tree, condensing individual files into directory and root-level summaries," which it says "reduced token overhead by over 85%, while preserving critical structural context across massive repositories." Treat the 85% as a vendor-reported efficiency figure — but note the idea: context compression is what makes whole-repo autonomous review tractable.

Mantis vs CodeMender: Google's two bets

Mantis is easy to confuse with CodeMender, the code-security agent Google DeepMind announced in October 2025. They are different projects with different jobs:

• CodeMender (Google DeepMind) is a closed, research-phase agent built on Gemini Deep Think. It patches new vulnerabilities and proactively rewrites code to remove whole classes of bugs — for example applying -fbounds-safety annotations to libwebp, the library behind CVE-2023-4863. It combines static and dynamic analysis, differential testing, fuzzing and SMT solvers with an LLM-judge critique step that checks patches for regressions before a human reviews them. DeepMind reported 72 security fixes upstreamed to open-source projects, some over 4.5 million lines of code. It is not publicly available.
• Mantis (Google security engineering) is an open, Apache-2.0 toolkit you can run yourself today — skills plus a harness — but explicitly demonstration-grade and with no published results.

Put simply: CodeMender is Google's flagship result (closed, with a track record); Mantis is the open method you can pick up and adapt. The full side-by-side is in our comparison of autonomous patching tools.

How to run it

Harness path (verbatim from the README):

1. Install python3-venv, then cd reference && ./install.sh
2. Authenticate Google Cloud ADC (if using Vertex AI)
3. python3 scripts/configure.py --auto, then python3 scripts/configure.py --test --probe
4. Launch a campaign: ./run.sh path/to/code

Useful flags: --focus, --exclude, --import-knowledge, --max-tokens, --no-budget, --parallel, --db-timeout, --objective.

Coding-agent quick start (from Google's blog): git clone https://github.com/google/mantis.git, then prompt your agent: "I would like to use the Mantis framework in path/to/mantis to review my code in path/to/your/code, can you help me get started?"

The caveats that matter

Mantis is genuinely exciting, and it is also explicitly guard-railed by its authors. Before you deploy it anywhere near real work:

• Human verification is mandatory. "All findings must be manually verified by a security expert before being reported."
• Run it isolated. The reproduction step executes generated code; run it only in "isolated, restricted environments."
• Do not spam maintainers. Google's blog: "Do not mass-file unverified, AI-generated reports to open-source maintainers." The wave of low-quality AI bug reports hitting OSS projects is a real problem; do not add to it.
• The PR Action is untested. Don't let it block merges yet.
• No benchmark exists. Nobody — including Google — has published a Mantis detection score. Anyone quoting one is making it up.

Where it fits

Mantis is the most directly comparable open framework to the autonomous find-and-patch systems that won DARPA's AI Cyber Challenge — it has the reproduce-and-verify loop, it is stack-agnostic (the README notes adaptability to hardware/RTL, infrastructure-as-code, ML pipelines and firmware), and it is free to self-host so your source never leaves your sandbox. The trade-off is that it is a platform to build on, not a product: you bring the frontier-model budget, the isolated infrastructure, and the security expert who verifies every finding. If you want the managed, closed equivalent, that is roughly what OpenAI's Aardvark is positioning as; if you want to see how Mantis stacks up against Aardvark, XBOW, Copilot Autofix and the AIxCC systems, read on.