Google open-sourced Mantis, 16 security review skills that run inside a coding agent you already use

Google has open-sourced Mantis, a toolkit that turns an existing coding agent into a vulnerability scanner. The GitHub repository describes it as "a modular, stack-agnostic toolkit of security review skills for AI coding agents to autonomously find, reproduce, and patch vulnerabilities." Google Cloud published the announcement on 2 September 2026. The GitHub API returned 947 stars, 96 forks and an Apache-2.0 licence when the repository was checked on 6 September.

The design point is that Mantis is not a program you run. It is a sequence of 16 named skills that a coding agent executes in order, starting with reading the version control history and building a structural index, then moving through architecture notes, a threat model, a scanning plan, the search itself, deduplication, review, and finally reproduction and patching. Google says it has used the skills with Gemini CLI and Antigravity CLI, and that any coding agent framework should work.

The number Google puts behind it

Two figures appear in Google's own post, and both are the company's own claims rather than independent measurements. Google states that hierarchical summary trees, which condense individual files into directory-level and root-level summaries, cut token overhead by over 85% while preserving structural context. Google also cites weak true-positive rates under 7% for conventional AI code scanning as the problem it set out to address.

Reproduction is the part that separates this from a scanner that emits a list. Mantis runs candidate findings in a sandbox and tries to prove them, which is how the critic and review skills decide what to keep.

The warnings are unusually direct

The README carries constraints that are worth reading before anyone installs this. It says in capitals to use it at your own risk, and tells you never to run the suite on a machine with access to production systems, sensitive data, or internal networks. It runs autonomously generated code that may be unstable, so Docker is required and gVisor is recommended for the sandbox.

Two more lines set the honest ceiling. Google writes that AI models are non-deterministic and can hallucinate findings or generate incorrect patches, so all findings must be manually verified by a security expert before being reported. It also says that failing to reproduce a vulnerability does not prove the finding was false. The repository states this is not an officially supported Google product and is not intended for production use.

Anyone running a security review still owns the verification step. What changes is where the expensive hours go: less time reading through machine-generated candidate lists that nobody has tried to prove, more time on the smaller set that survived a sandbox reproduction attempt. That only helps if the team treats the output as a queue for a human reviewer rather than as a result. A patch suggested by an agent that hallucinated the flaw behind it is worse than no patch, because it looks like the work was done.

The licence matters too. Apache-2.0 means a team can read exactly what each of the 16 skills asks the model to do, and change any of them, which is a different proposition from a scanning product whose prompts are hidden.

Source

Getting started with the Mantis harness to find and fix bugs, Google Cloud, and the google/mantis repository.