Google Mantis: An AI-Agent Framework for Automated Vulnerability Scanning

Google's Mantis framework represents a significant advancement in automated software vulnerability scanning. Unlike traditional AI-powered scanners that often suffer from high false positive rates and 'hallucinated' vulnerabilities, Mantis employs a sophisticated, agent-based architecture to enhance accuracy and reliability. This system design focuses on reducing noise and providing actionable insights, crucial for maintaining security in large codebases.

Agentic Architecture for Enhanced Accuracy

Mantis utilizes industry-standard agentic techniques, orchestrating multiple AI agents to perform different stages of vulnerability analysis. This multi-agent approach mimics a human security researcher's workflow, incorporating verification and validation steps to filter out erroneous findings.

• Strategist Agent: Evaluates high-level code structure, threat models, and dependency graphs.
• Research Agents: Examine raw source files in depth, tracing data and control flows, and sanitization logic.
• Critic & Reviewer Agents: Filter out false positives and prioritize meaningful findings, applying rule-based negative filters cautiously.
• Reproducer Agent (mantis-reproduce): Writes functional crash reproducers to validate vulnerabilities in a sandboxed environment.
• Patcher Agent (mantis-patch): Generates side-effect-free fixes for identified vulnerabilities.

Contextual Analysis and Modular Design

Instead of brute-force scanning, Mantis analyzes repository history, previous security fixes, architecture, and threat models. It then summarizes this information into a hierarchical tree, significantly reducing token usage (by 85%) for LLMs while retaining crucial structural context. The system is designed as a modular skill suite with over 15 tools, allowing agents to execute sequentially or in parallel and communicate via a shared state on disk.