# Google Mantis: An Open-Source Toolkit for AI Agents That Find, Reproduce, and Patch Bugs

> Google quietly open-sourced Mantis (Apache-2.0) in September 2026 — a modular, stack-agnostic toolkit that lets an AI coding agent autonomously find, reproduce in a sandbox, and patch vulnerabilities, verifying each fix with an adversarial loop. What it is, how the pipeline works, how to run it, and the caveats that matter.

Source: https://playciso.com/blog/google-mantis-autonomous-vulnerability-patching · Published: 2026-10-27 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://github.com/google/mantis

---

On September 2, 2026, Google open-sourced **Mantis** at [github.com/google/mantis](https://github.com/google/mantis) under the Apache-2.0 licence. The repository's one-line description is the sentence that caught everyone's eye: "A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities." That is the ambition the whole autonomous-AppSec field has been circling. Here is what Mantis actually is, how its find → reproduce → patch loop works, how to run it, and the caveats Google itself flags. ## What Mantis is (and is not) A naming nuance worth getting right: the "autonomously find, reproduce, and patch" line is the repo's GitHub _About_ blurb that Google set. The README's own heading is _"Mantis: Portable Toolkit for Building Secure Software,"_ and it describes Mantis as "a set of skills along with an ADK reference harness for building secure software." Both framings are real; the toolkit spans proactive secure-coding help _and_ reactive find-and-fix. Two disclaimers are load-bearing and belong in any honest write-up. The README states: **"This is not an officially supported Google product"** and **"This project is intended for demonstration purposes only. It is not intended for use in a production environment."** So it sits under the official `google` org and reflects Google's internal find-and-fix approach (per the [Google Cloud Security blog](https://cloud.google.com/blog/products/identity-security/getting-started-with-the-mantis-harness-to-find-and-fix-bugs), by security engineers Nick Galloway and Yulong Zhang) — but it is a demonstration framework to build on, not a supported product, and not a model release. ## The three pieces - skills/ — the method. The security workflow expressed as agent skills: threat modelling, research, review, patching, and reporting. A mantis-advise skill feeds accumulated knowledge back so agents "write secure code the first time." - reference/ — the harness. An ADK (Agent Development Kit) reference harness that runs the method as a pipeline, built around Vertex AI and "frontier models" (the README does not pin a specific model). - action/ — the GitHub Action. Runs the harness over pull requests. Note: the README calls this PR scan "untested" and warns it should not gate merges. ## How the loop works What separates Mantis from a scanner-plus-fix-suggester is that it attempts the _entire_ loop and verifies its own work: - Learn the codebase. It reviews repo history to learn from past security fixes, auto-builds architecture and threat-model docs even when none exist, and builds a semantic index. - Hypothesise and triage. It generates research hypotheses about where bugs might be, then uses critic and reviewer agents to dedupe and triage them — the explicit goal is cutting false positives before a human ever sees them. - Reproduce in a sandbox. For a surviving candidate it attempts to write a proof-of-concept and run it with networking disabled, looking to actually trigger the crash — and to chain vulnerabilities where possible. - Patch and prove the fix. It patches, then runs "an adversarial loop to verify the vulnerability is really fixed." A patch counts only if the demonstrated reproducer no longer fires. Google also describes a scaling trick: Mantis "constructs a hierarchical security summary tree, condensing individual files into directory and root-level summaries," which it says "reduced token overhead by over 85%, while preserving critical structural context across massive repositories." Treat the 85% as a vendor-reported efficiency figure — but note the _idea_: context compression is what makes whole-repo autonomous review tractable. ## Mantis vs CodeMender: Google's two bets Mantis is easy to confuse with **CodeMender**, the code-security agent Google DeepMind announced in October 2025. They are different projects with different jobs: - CodeMender (Google DeepMind) is a closed, research-phase agent built on Gemini Deep Think. It patches new vulnerabilities and proactively rewrites code to remove whole classes of bugs — for example applying -fbounds-safety annotations to libwebp, the library behind CVE-2023-4863. It combines static and dynamic analysis, differential testing, fuzzing and SMT solvers with an LLM-judge critique step that checks patches for regressions before a human reviews them. DeepMind reported 72 security fixes upstreamed to open-source projects, some over 4.5 million lines of code. It is not publicly available. - Mantis (Google security engineering) is an open, Apache-2.0 toolkit you can run yourself today — skills plus a harness — but explicitly demonstration-grade and with no published results. Put simply: CodeMender is Google's flagship result (closed, with a track record); Mantis is the open method you can pick up and adapt. The full side-by-side is in our [comparison of autonomous patching tools](/blog/autonomous-ai-vulnerability-patching-tools-compared). ## How to run it **Harness path (verbatim from the README):** - Install python3-venv, then cd reference && ./install.sh - Authenticate Google Cloud ADC (if using Vertex AI) - python3 scripts/configure.py --auto, then python3 scripts/configure.py --test --probe - Launch a campaign: ./run.sh path/to/code Useful flags: `--focus`, `--exclude`, `--import-knowledge`, `--max-tokens`, `--no-budget`, `--parallel`, `--db-timeout`, `--objective`. **Coding-agent quick start (from Google's blog):** `git clone https://github.com/google/mantis.git`, then prompt your agent: _"I would like to use the Mantis framework in path/to/mantis to review my code in path/to/your/code, can you help me get started?"_ ## The caveats that matter Mantis is genuinely exciting, and it is also explicitly guard-railed by its authors. Before you deploy it anywhere near real work: - Human verification is mandatory. "All findings must be manually verified by a security expert before being reported." - Run it isolated. The reproduction step executes generated code; run it only in "isolated, restricted environments." - Do not spam maintainers. Google's blog: "Do not mass-file unverified, AI-generated reports to open-source maintainers." The wave of low-quality AI bug reports hitting OSS projects is a real problem; do not add to it. - The PR Action is untested. Don't let it block merges yet. - No benchmark exists. Nobody — including Google — has published a Mantis detection score. Anyone quoting one is making it up. ## Where it fits Mantis is the most directly comparable _open_ framework to the autonomous find-and-patch systems that won DARPA's AI Cyber Challenge — it has the reproduce-and-verify loop, it is stack-agnostic (the README notes adaptability to hardware/RTL, infrastructure-as-code, ML pipelines and firmware), and it is free to self-host so your source never leaves your sandbox. The trade-off is that it is a platform to build on, not a product: you bring the frontier-model budget, the isolated infrastructure, and the security expert who verifies every finding. If you want the managed, closed equivalent, that is roughly what OpenAI's Aardvark is positioning as; if you want to see how Mantis stacks up against Aardvark, XBOW, Copilot Autofix and the AIxCC systems, read on.