Google open-sources Mantis to cut scanner false alarms
The framework chains specialized agents, reproduces findings in a sandbox, and cuts token use for code intake by 85 percent, Google says.
Symbolic image: at a security workstation, a person seen from behind cables up a running test server whose status LEDs are blinking.
Mantis is Google's newly open-sourced agent framework that reports a vulnerability only after one of its agents has reproduced the bug inside a sandbox.
At a glance
- Mantis is open source and hosted on GitHub; Google describes a flow from finding to review, reproduction and patch.
- Google's stated motivation: conventional AI code scanners hit true-positive rates below 7 percent and hallucinate vulnerabilities.
- More than 15 skills, among them mantis-summarize, mantis-review, mantis-critic, mantis-dedupe, mantis-reproduce and mantis-patch.
- Hierarchical summary trees cut token use during code intake by 85 percent.
- The report states no measured hit rate for Mantis itself.
Google has released Mantis as open source: an agent framework that tries to trigger a suspected flaw inside an isolated environment before the finding ever reaches a human queue. That reproduction step is the whole pitch. InfoQ described the tool on September 6, 2026.
Why false positives are the target
By Google's own account, conventional AI code scanning delivers true-positive rates below 7 percent, alongside bugs the model simply invented. Google blames “sloppiness” in that approach and positions Mantis as the corrective. The economics are blunt: a triage queue stuffed with phantom findings is a queue nobody finishes reading.
Splitting the job across agents
Strategist agents read a project's structure, its earlier security fixes and its threat model. Researcher agents walk data and control flow through individual source files, while critic and reviewer agents throw out what does not hold up. A reproduction agent then fires the bug in a sandbox, turning a claim into evidence.
Under the hood sit more than 15 skills, among them mantis-summarize, mantis-review, mantis-critic, mantis-researcher, mantis-dedupe, mantis-reproduce and mantis-patch. They run in sequence or in parallel and hand state to one another through shared storage on disk. mantis-patch is meant to generate fixes that carry no side effects.
Cutting 85 percent of the tokens
To fit a large repository into a context window, Mantis condenses analyzed files into hierarchical trees that carry directory- and repository-level context. Google puts the saving at 85 percent of token use with the structural information preserved. It also advises matching model tier to task: lite variants for fast classification and deduplication, stronger models for deep contextual reasoning and patch generation.
The filter Google warns about
The review stage relies on rule-based negative filters that sweep away known false-alarm patterns. Google cautions against drawing that filter too wide: writing off low-risk findings as false positives by default erodes the system's ability to catch genuine vulnerabilities. For a tool sold on precision, that is a candid limit to publish.
What is not on the record
The number that matters most is absent. Nothing in the available report states the true-positive rate Mantis itself reaches; the 7 percent figure describes the prior art, not the new harness. We also have no license details, no benchmark data and no head-to-head comparison with other security agents.
FAQ
What is Google Mantis?
An open-source agent framework from Google that automates the vulnerability lifecycle, from spotting an issue through review and sandboxed reproduction to a proposed fix.
Where can I get Mantis?
Google published the code on GitHub together with a reference guide to the individual stages. The available report does not specify the license.
How does Mantis reduce false positives?
With critic and reviewer agents, rule-based negative filtering, and above all by reproducing a candidate bug in a sandbox as proof that it is real.
