{"slug": "getting-started-with-mantis-our-open-source-bug-finding-and-fixing-harness", "title": "Getting started with Mantis, our open-source bug finding-and-fixing harness", "summary": "Google has released Mantis, an open-source framework that automates the discovery, triage, reproduction, and patching of software vulnerabilities, achieving true-positive rates above 7% by combining agentic techniques with sandboxed reproduction. The tool reduces token overhead by over 85% through hierarchical security summaries and is available on GitHub, with Google reporting it has already found real vulnerabilities internally.", "body_md": "AI models have clearly proven their ability to discover and exploit vulnerabilities without much, if any, human assistance. To help defenders gain the advantage with AI, we built the Mantis harness to automate the discovery, triage, reproduction, and patching of software vulnerabilities.\n\nAvailable to all as an open-source framework, Mantis is part of Google’s internal approach to find and fix vulnerabilities at machine-speed. It creates a more effective scalable, context-aware repository analysis.\n\nWhile sloppiness in AI code scanning frequently leads to hallucinated bugs and weak true-positive rates under 7%, we designed Mantis to be effective by combining industry-standard agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities for grounding.\n\nAs we [detailed in June](https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-how-google-cloud-security-uses-ai-internally/?e=48754805), it examines the history of the repository to learn from past security fixes and automatically builds up architectural and threat model documentation, even if these are not provided.\n\nIt constructs a hierarchical security summary tree, condensing individual files into directory and root-level summaries. This technique reduced token overhead by over 85%, while preserving critical structural context across massive repositories.\n\nMantis distills decades of cybersecurity expertise across a wide spectrum of codebases, and is [available on GitHub](https://github.com/google/mantis). Here’s how you can get started using Mantis.\n\n**First**, clone the Mantis repo locally using:\n\n**Second**, open your [favorite coding agent](https://antigravity.google/docs/enterprise/) and use the prompt, “I would like to use Mantis framework in `path/to/mantis`\n\nto review my code in `path/to/your/code`\n\n, can you help me get started?”\n\nInternally at Google, this exact prompt has been used to find real vulnerabilities across our many code repositories. As part of the Mantis repository on GitHub, we’ve included sample sandboxing options. You can also implement your own sandbox to match your own workflow.\n\nMantis is intended to be an easy place to start with vulnerability discovery, true positive filtering, and patching. Once you've got a handle on AI-discovered vulnerabilities, you can use the new [mantis-advise skill](https://github.com/google/mantis/blob/main/mantis-advise/SKILL.md) to make use of the accumulated knowledge and get your coding agents to write secure code the first time.\n\nTo get the most out of AI-driven vulnerability discovery and modernize your development practices, we strongly recommend two essential practices:\n\n**Feed your tools the right context**: While Mantis automatically analyzes commit history and code to build documentation for itself, human-curated knowledge often can dramatically improve the quality of your results. For example, if you would never waste time fixing bugs where the user can crash their own program, this is critical information for a scanning pipeline to ensure that those types of bugs are never surfaced.\n\n**Build a cyber sandbox with vulnerability acceptance criteria**. Safe, sandboxed environments where you can reproduce vulnerabilities with clear vulnerability-reproduction criteria will give you better results for surfacing only the things you need to know and also for ensuring that your fixes are correct.\n\nYou can [learn more about Mantis here](https://github.com/google/mantis/issues).", "url": "https://wpnews.pro/news/getting-started-with-mantis-our-open-source-bug-finding-and-fixing-harness", "canonical_source": "https://cloud.google.com/blog/products/identity-security/getting-started-with-the-mantis-harness-to-find-and-fix-bugs/", "published_at": "2026-09-02 16:00:00+00:00", "updated_at": "2026-09-02 16:23:41.213702+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "ai-agents", "ai-research"], "entities": ["Google", "Mantis", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/getting-started-with-mantis-our-open-source-bug-finding-and-fixing-harness", "markdown": "https://wpnews.pro/news/getting-started-with-mantis-our-open-source-bug-finding-and-fixing-harness.md", "text": "https://wpnews.pro/news/getting-started-with-mantis-our-open-source-bug-finding-and-fixing-harness.txt", "jsonld": "https://wpnews.pro/news/getting-started-with-mantis-our-open-source-bug-finding-and-fixing-harness.jsonld"}}