Google's Mantis: an open AI toolkit that finds and fixes security bugs
ShiniFrontiers · Source: Google
What problem does it solve?
Does your team build software? Google's Mantis is a free toolkit that uses AI to find the security holes in your code and draft the fixes — but it's a lab tool, not a product: run it in a sandbox and have an expert check every result.
What it is: Mantis is a free, public toolkit from Google — a set of agent skills plus a reference harness built on Google's Agent Development Kit (ADK, a framework for building AI agents). You point it at a codebase and it runs AI agents that build a threat model, hunt for vulnerabilities across every file, try to reproduce each one, rank them by severity, and propose patches it then checks by attacking its own fix.
Who it's for: Teams that write and maintain software and want AI help finding and fixing security flaws before attackers do, and the security leaders weighing whether AI vulnerability-finding is ready to lean on.
The catch: Google labels Mantis "demonstration purposes only" — not supported, not for production — and requires a human expert to verify every finding, because the models hallucinate. It must run in an isolated sandbox. (Google's strongest security-tuned model, Gemini 3.8 Flash Cyber, is gated to vetted defenders through its Fairwind Program; Mantis itself runs on a model you can access, such as the general Gemini 3.8 Flash.)
An AI harness that reviews your code for security flaws — for teams that build and maintain software
Problem: Finding security flaws in a large codebase is slow and expensive: a few experts read code by hand and still miss things, while pattern-based scanners flag thousands of issues, most of them noise. A software vulnerability — a flaw an attacker can exploit — can hide in logic no rule-based scanner models.
What it does: You point Mantis at a copy of your code and it runs a chain of AI agents — programs that use a language model to plan and act. They build a threat model (a map of what could go wrong), hunt across every file, try to reproduce each suspected flaw, rank them so the real criticals surface instead of thousands, and propose a patch they then attack to check it holds. You supply the AI model that drives them. Think of it as a tireless review team that drafts findings and fixes for your experts to check — never one that ships them on its own.
Note: It finds and drafts; it does not decide. Google is explicit that a security expert must verify every finding, and that it must run in an isolated sandbox.
See the difference
| The situation | Today (a typical team) | With Mantis |
|---|---|---|
| A large codebase to audit for security flaws | A few experts review by hand, slowly, and miss things | AI agents review every file and build a threat model, surfacing candidate findings |
| A possible vulnerability is flagged | It sits in a queue; sorting real from false eats expert time | Mantis tries to reproduce it (even spinning up a mock server) and critiques itself to cut false alarms — a human still confirms each |
| A flood of "critical" alerts | Alert fatigue; the real risks hide among thousands | Findings are calibrated against a rubric so the few true criticals surface, not thousands |
| A confirmed vulnerability needs fixing | An engineer writes and tests the patch | Mantis proposes a patch and attacks its own fix to check it closes the hole, for a human to review |
From the Mantis README. Mantis is demonstration-grade; a security expert must verify every finding before it is trusted, patched or reported.
- What it saves
A whole-codebase AI review that reproduces bugs to cut false alarms, calibrates severity so the real criticals surface, and proposes fixes it adversarially checks — coverage a small expert team cannot match by hand.
- What it costs
Free and public, but demonstration-grade: it must run in an isolated sandbox, every finding needs expert review, and you supply the AI model that drives it (for example the general Gemini 3.8 Flash, $0.75 / $3.75 per million input/output tokens, introductory to 31 Dec 2026).
- How ready
- Proven in the lab
Open and runnable now, but Google calls it demonstration-only, not for production; it needs an isolated sandbox and a human to verify every finding.
Join free to unlock: how it works, a step-by-step setup with its costs, what you gain, and where it falls short, for every Friday idea.
Join free to read it all →