Google open-sources Mantis, an AI-powered bug finding and fixing harness

Introducing Mantis: An AI-Powered Security Harness

Google has released Mantis, an open-source framework developed to automate the process of finding and fixing software vulnerabilities. This tool is part of Google's internal strategy to address security flaws at machine speed, providing a more scalable and context-aware approach to repository analysis.

Addressing AI Code Scanning Challenges

Traditional AI code scanning often struggles with false positives and low true-positive rates. Mantis addresses these issues by integrating industry-standard agentic techniques, such as critic and review agents, with sandboxed vulnerability reproduction for grounding. This combination is intended to enhance the accuracy of vulnerability detection.

Advanced Repository Analysis

Mantis analyzes repository history to learn from past security fixes and automatically generates architectural and threat model documentation. It constructs a hierarchical security summary tree, condensing file information into directory and root-level summaries. This method reduces token overhead by over 85% while maintaining critical structural context across large codebases.

Getting Started with Mantis

The framework is available on GitHub, and users can clone the repository to begin. Google suggests using a prompt with a coding agent to initiate code reviews with Mantis. The tool also includes sample sandboxing options, allowing users to implement custom sandbox environments to fit their workflows.

Enhancing Development Security

Mantis is designed to simplify vulnerability discovery, true positive filtering, and patching. It also offers a 'mantis-advise' skill, which uses accumulated knowledge to help coding agents write secure code from the outset. Google recommends feeding tools with relevant data to maximize the benefits of AI-driven vulnerability discovery.