SECURITY Signal 80
Google open-sources Mantis, an agentic scanner that reproduces vulnerabilities in sandboxes to cut false positives
↗
Google has open-sourced Mantis, an AI-agent framework that automates the vulnerability lifecycle and uses sandboxed reproduction to reduce false positives.
For security engineers, Mantis offers a way to automate vulnerability validation and patching with evidence from sandboxed reproduction, addressing the low true-positive rates of conventional AI scanners. It also demonstrates a modular approach where different models handle different stages, potentially reducing cost and improving accuracy.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Mantis analyzes repository history, security fixes, architecture, and threat models, summarizing files into a hierarchical tree to cut token usage by 85%.
It uses critic and reviewer agents plus a strategist agent and research agents to filter false positives and prioritize findings.
It supports multiple models and includes over 15 tools, with stages communicating via shared state on disk.
THE CLUSTER