Google Open-Sources Mantis: An AI Agent Framework to Cut False Positives in Vulnerability Scanning

Google has made available as open source a new AI-agent framework called Mantis, designed to automate the full software vulnerability lifecycle—from identifying and validating vulnerabilities to reproducing and fixing them. The company says it built Mantis to tackle the persistent problem of high false-positive rates and hallucinated vulnerabilities that often plague conventional AI-powered code scanning tools.

Addressing the False Positive Problem in AI Code Scanning

Traditional AI-based vulnerability scanners frequently flag issues that are not real security flaws, or even invent vulnerabilities that do not exist. Google developed Mantis specifically to reduce these inaccuracies, providing a more reliable approach to automated security analysis.

How Mantis Automates the Vulnerability Lifecycle

Mantis is built as an agentic framework, meaning it can act autonomously across different stages of vulnerability management. Instead of merely pointing out potential weaknesses, it aims to validate them, reproduce the conditions under which they occur, and even generate fixes—all within an automated pipeline.

From Detection to Patching

The framework is designed to handle the entire process: it identifies potential vulnerabilities, verifies whether they are genuine, reproduces them to confirm their impact, and then works on patching the underlying issue. This end-to-end capability is intended to save security teams significant time and effort.

Open Source Availability

By releasing Mantis as an open-source project, Google is allowing the broader security community to use, inspect, and contribute to the framework. This move is expected to help advance the state of automated vulnerability scanning and reduce reliance on manual review of noisy scanner output.