Google Releases Mantis: Open-Source AI Security Toolkit That Autonomously Hunts and Patches Software Vulnerabilities

Google releases Mantis, an open-source AI security toolkit that autonomously hunts, reproduces, and patches software vulnerabilities across hardware, firmware, and ML pipelines using a 15-component pipeline coordinated by a meta-agent, though all findings require manual expert verification before action.

• Google's Mantis is an open-source, modular security toolkit designed for AI coding agents to autonomously find, reproduce, and patch vulnerabilities across any software stack, including hardware, firmware, IaC, and ML pipelines.
• The pipeline consists of 15 sequential components — from architecture analysis and threat modeling to proof-of-concept reproduction, exploit chaining, patching, and risk calibration — all coordinated by an overarching meta-agent that maintains state via JSON finding files.
• Responsible use is strongly emphasized, requiring isolated execution environments such as hardened GCE VMs with network restrictions and least-privilege IAM roles, as all AI-generated findings must be manually verified by security experts before being reported or acted upon.