Google's Mantis release is less interesting as another autonomous scanner than as a workflow contract: a suspected vulnerability does not become a finding, patch, or report until it passes distinct evidence gates.
A Staged Security Review
Google introduced the open-source Mantis harness on September 2, 2026. It packages security work as a sequence of portable skills for coding agents rather than one prompt that jumps from repository access to a patch.
The repository's manual pipeline builds architectural context and a threat model before discovery, then deduplicates, reviews, criticises, reproduces, patches, calibrates, and reports. Each stage has a more specific claim than “the model found a bug.”
The Boundary Matters More Than The Prompt
Mantis warns that generated code may be unstable, findings may be hallucinated, and patches may be wrong. It requires manual verification by a security expert before a finding is reported and warns against mass-filing unverified output.
Reproduction and patch execution are meant to occur in restricted containers or a dedicated virtual machine, without production systems, sensitive data, internal networks, or ordinary host execution. The repository explicitly says its agent instructions are not an absolute safety guarantee.
An Evidence Ladder For Autonomous Security
- Candidate: a model proposes a plausible weakness.
- Reviewed: duplicate and non-viable claims have been filtered.
- Reproduced: a bounded test demonstrates the failure in an isolated target.
- Patched: a minimal change blocks that reproducer without breaking required behavior.
- Reportable: a qualified human has reviewed the claim and disclosure path.
Preserve those states and their artifacts separately. A successful agent run should not silently advance a claim from candidate to disclosed vulnerability.
Scope And Limits
Mantis is a toolkit and starting point, not independent evidence of detection quality across arbitrary codebases. Google's blog describes internal use, but the public sources do not provide a representative external benchmark or prove that every generated patch is safe.
Its transferable contribution is procedural: threat-model context, staged claims, isolated execution, narrow scans first, and a human-owned disclosure decision.
Related: Read our field notes on evaluation agents crossing into production systems and agent sandbox controls.