What changed
On September 2, Google Cloud published a getting-started guide for Mantis, an open-source toolkit that lets AI coding agents review software for vulnerabilities. The Mantis repository describes it as modular and stack-agnostic: it can find candidate issues, triage them, reproduce them in a sandbox, propose a minimal patch, and produce a report for a human to review.
This is a different product shape from asking an agent to “scan this code.” Mantis is a sequence of specialized skills with explicit handoffs between architecture, planning, deduplication, review, criticism, reproduction, patching, calibration, reflection, and reporting.
Why the harness matters
The most important idea is that security quality comes from the workflow around the model, not only from the model’s ability to spot suspicious code. Mantis adds three layers that ordinary AI code review often lacks:
- Repository context. It studies commit history and builds architectural and threat-model documentation, including a hierarchical summary tree. Google says that summary approach reduced token overhead by more than 85% while preserving important repository context.
- Adversarial review. Separate critic and review stages are used to filter hallucinated or non-viable findings before they become reports.
- Executable evidence. The reproduction stage runs generated proof-of-concept crash reproducers inside sandboxes, and the patch stage checks that the proposed fix blocks the reproducer.
That sequence is the product insight: an agent becomes more useful when the system makes it earn a finding with context, evidence, and a reviewable change.
The practical boundary
Mantis is an experimental starting point, not an unattended security service. Its repository warns that generated code may be unstable or perform unexpected actions, requires isolated and restricted environments, and says every finding must be manually verified by a security expert. It also says the project is for demonstration purposes and is not intended for production use.
That boundary is healthy. A security agent can have access to source code, build tools, test fixtures, and sandbox infrastructure; it should not have an implicit path to production systems or automatic mass-reporting. Reproduction success is evidence that a particular test case can be recreated, not proof that a vulnerability is exploitable in every deployment.
Builder takeaway
For teams building AI-assisted security or code-quality products, Mantis is a useful architecture to study. Start with a disposable repository and define acceptance criteria before the agent runs: what counts as a real issue, what evidence is required, which files may be changed, and who approves the result. Measure true-positive rate, false-positive rate, reproduction success, patch correctness, token use, and time to review.
The broader lesson is that agent products are moving from single prompts toward controlled pipelines. The differentiator is increasingly the evidence loop around the model: context construction, independent criticism, safe execution, and a human decision at the end.