Google has open-sourced Mantis, a modular toolkit designed to give autonomous AI coding agents end-to-end capabilities across the software vulnerability lifecycle. Rather than acting as a standalone static scanner, Mantis operates as a structured collection of slash commands and execution rules that integrate into frameworks like Gemini CLI, Google ADK, or Antigravity CLI.
The toolkit automates sequential security operations including mining commit histories, constructing threat models, deduplicating candidate bugs, executing exploits inside sandboxed gVisor or isolated VM environments, generating patches, and verifying fix effectiveness. A dedicated meta-agent supervisor coordinates the multi-stage pipeline during long-lived agent sessions.
Currently intended for local and internal testing rather than immediate production deployment, Mantis is publicly available on GitHub to assist development teams in automating vulnerability review workflows.
Why it matters
Automating the full exploit-reproduce-patch lifecycle enables engineering teams to catch and fix vulnerabilities before deployment.
Sandboxed execution harnesses establish safer boundaries for running high-privilege agentic coding and security workflows.
Source: marktechpost.com
