Google Releases Open-Source Mantis Framework to Automate Software Security Audits

Key facts

In a public release announced on September 6, 2026, Google made the codebase for its Mantis framework available to the global software development and cybersecurity community. According to reporting by Sergio De Simone, Google engineered the tool as an agentic harness to solve persistent operational bottlenecks in how automated security systems identify, triage, and repair vulnerabilities in source code.

For decades, automated security auditing has depended heavily on static analysis engines that parse source code line by line to identify patterns associated with security weaknesses. While these tools offer broad coverage, they frequently generate excessive false positives—flagging code segments that appear hazardous in isolation but are safely neutralized by surrounding application logic, data sanitization functions, or unreachable execution paths. In recent years, the integration of generative artificial intelligence and large language models (LLMs) promised to make vulnerability detection more flexible. However, ungrounded LLMs introduced a new problem by routinely "hallucinating" security flaws, presenting benign code constructs as dangerous vulnerabilities or fabricating non-existent exploit vectors.

Google developed Mantis to replace passive analysis with active, tool-assisted verification. Rather than relying on a single static check or a simple prompt-and-response model, Mantis orchestrates a network of dedicated AI agents equipped with access to compilers, debuggers, and execution environments. When a potential vulnerability is flagged within a codebase, Mantis does not immediately alert human engineers. Instead, its agents write and execute a proof-of-concept attack script inside an isolated sandbox to test if the vulnerability can actually be triggered at runtime.

If the proof-of-concept fails to produce an unsafe execution state, Mantis filters out or downgrades the alert, preventing unnecessary disruption to development teams. If the exploit succeeds in demonstrating a genuine flaw, the framework logs the exact reproduction steps and hands the task to a remediation agent. This secondary agent drafts a source code patch designed to seal the flaw, then re-runs both the original exploit script and existing application unit tests to ensure the fix eliminates the vulnerability without causing regression errors.

Why it matters

The release of Mantis addresses one of the most pressing operational bottlenecks in modern enterprise software engineering: alert fatigue in cybersecurity operations. Modern corporate software repositories rely heavily on interconnected open-source dependencies, which often make up 80 to 90 percent of a final application's total codebase. When enterprise DevSecOps pipelines run continuous security scans across millions of lines of code, security operations centers and developer teams are routinely inundated with thousands of low-confidence security notifications.

When engineers are forced to spend hundreds of hours manually investigating phantom security flaws, productivity drops, product releases are delayed, and developer trust in automated security tooling severely erodes. In extreme cases, severe, actionable vulnerabilities can be overlooked simply because they are buried beneath a mountain of irrelevant warnings.

By substituting statistical pattern matching with empirical, agent-driven execution, Mantis offers a framework that can drastically lower the cost and friction of maintaining secure software supply chains. For open-source maintainers—many of whom manage widely used global software infrastructure on a volunteer basis—the introduction of automated verification and patch generation could transform vulnerability management. Small maintainer teams currently overwhelmed by automated bug-reporting bots could deploy agentic harnesses to triage incoming reports automatically, allowing human maintainers to focus their time exclusively on high-priority architectural decisions and complex code reviews.

To understand why Google built Mantis, it is necessary to examine the historical trajectory of application security testing and the recent shift toward agentic AI systems. Historically, automated software auditing relied on two main methodologies: Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST).

Static Application Security Testing tools inspect raw, uncompiled source code for syntax patterns known to cause vulnerabilities, such as unvalidated user inputs or insecure cryptographic function calls. While SAST provides comprehensive coverage early in the development lifecycle, its inability to observe runtime data flows leads to notoriously high false-positive rates. Conversely, Dynamic Application Security Testing tools probe compiled, running applications from the outside to uncover accessible vulnerabilities. While DAST produces far fewer false positives because it observes actual runtime behavior, it requires complex deployment environments and often fails to reach deep, conditional logic paths buried within application backends.

When enterprise tech companies began applying large language models to code security between 2022 and 2024, early implementations exposed fundamental architectural limits. Because LLMs operate as probabilistic text-completion systems rather than deterministic execution engines, they struggle with spatial reasoning over multi-file codebases and frequently invent non-existent security risks when presented with complex syntax.

To overcome these boundaries, computer science research shifted toward "agentic" AI architectures during 2024 and 2025. In an agentic framework, an LLM operates within an iterative control loop, utilizing external tools, command-line interfaces, compilers, and test environments to validate its internal reasoning before generating a final answer. Google's release of Mantis builds on its long-standing cybersecurity research programs—including its Project Zero vulnerability research unit and its OSS-Fuzz automated testing infrastructure—by applying agentic loops directly to the software security lifecycle. By requiring AI agents to prove vulnerabilities through runtime execution and verify fixes through regression testing, Mantis grounds artificial intelligence models in empirical, deterministic software behavior.

Reaction

Because Mantis was released as an open-source project on September 6, 2026, formal industry evaluations and enterprise case studies remain limited in the immediate aftermath of the announcement. However, software maintainers and application security professionals are expected to subject the framework to rigorous practical testing. On developer forums and public code repositories, security engineers have expressed long-standing demand for tools capable of reducing false positive noise, particularly following years of automated reporting tools cluttering open-source project issue trackers with unverified vulnerability claims.

Enterprise DevSecOps teams are anticipated to run trial integrations of Mantis within continuous integration and continuous deployment pipelines to assess key performance metrics, such as model token consumption, runtime latency, and infrastructure costs. Industry standards organizations, including the Open Source Security Foundation (OpenSSF), are also key stakeholders likely to monitor whether agentic scanning harnesses can be standardly integrated into public open-source software auditing infrastructure to protect critical global digital infrastructure.

What we don't know yet

Despite the details provided upon its release, several key operational parameters regarding Mantis remain unverified in the initial reporting. It is currently unclear which specific large language model backends—such as Google's Gemini models or third-party open-weight models—are supported by default, or what level of fine-tuning is required for optimal performance across different programming languages.

Furthermore, public reporting has not yet established detailed benchmark figures comparing Mantis's false-positive reduction rates directly against established industrial SAST and DAST platforms like SonarQube, Snyk, or GitHub CodeQL. The initial reporting also does not clarify how Mantis performs when auditing complex distributed systems, microservice architectures, or applications requiring specialized authentication states and external database setups that are difficult to replicate inside automated sandbox environments. Finally, cybersecurity analysts will be closely monitoring whether the automated exploit reproduction capabilities within Mantis could potentially be weaponized by threat actors seeking to accelerate offensive zero-day vulnerability exploitation.

What to watch

Over the coming months, several concrete indicators will determine the adoption rate and practical efficacy of the Mantis framework across the technology industry. First, industry analysts will observe the official Mantis GitHub repository to track open-source community contributions, third-party plugin developments, and integration connectors for major deployment platforms such as GitHub Actions, GitLab CI, and Jenkins.

Second, independent academic institutions and cybersecurity research laboratories are expected to publish formal comparative studies, testing Mantis against established vulnerability datasets like the OWASP Benchmark or the NIST Juliet Test Suite to measure its exact precision, recall, and patch accuracy metrics. Third, industry watchers will look for announcements regarding the internal deployment of Mantis within Google's own software development infrastructure or its integration into enterprise cloud offerings like Google Cloud Security Command Center. Finally, major open-source software foundations will serve as a key indicator as maintainers decide whether to officially accept Mantis-verified patches in public repository workflows.

This account is based on original reporting by Sergio De Simone.