Google Open-Sources Mantis: A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities

Google has open-sourced Mantis, a modular security toolkit built for coding agents that already exist. It is not a point-and-shoot scanner. Instead, it drops in as a set of slash commands and rules that guide an agent through a full security review, from finding a suspected flaw to reproducing it, patching it, and testing the fix again.

That pipeline is split into separate skills. Mantis starts by learning the target with commands like /mantis-history, /mantis-summarize, /mantis-architecture, /mantis-threat-model and /mantis-plan. Then it narrows the field with /mantis-researcher, /mantis-dedupe, /mantis-review and /mantis-critic, which are meant to remove duplicates, apply negative rules and discard issues that could not happen in a release build.

The more interesting part comes later. /mantis-reproduce runs payloads in gVisor or a VM with networking turned off. /mantis-chain can combine confirmed findings into multi-step exploit chains. /mantis-patch applies and verifies the fix, /mantis-calibrate gives the risk a score from 1 to 10, and /mantis-report turns the whole thing into something a human can read. There is also /mantis-reflect, which feeds learnings back into the next pass.

Google says the model is aimed at local and internal evaluation, not production. That caution makes sense, because Mantis is built around a trust boundary that most agentic security tools skip: the reproducer and the re-attack. The company also says its hierarchical summary tree cuts token overhead by more than 85 percent, and it cites sub-7 percent true-positive rates for naive AI code scanning as the problem this setup is meant to address.

A newer command, /mantis-advise, flips the process around and checks the accumulated threat model, bug history and verified patch patterns before code gets written. That is the useful bit here. Fewer heroic prompts, more boring guardrails. Exactly the sort of unglamorous discipline security tooling usually needs.