Google's Mantis Cuts AI Security False Positives With Sandbox-First Pipeline

Google has released Mantis as an open-source project under the Apache 2.0 license, giving AI coding agents a structured, stage-by-stage toolkit for running the entire vulnerability lifecycle — from initial suspicion through sandboxed reproduction to patch verification and risk scoring. The release targets a specific, documented failure mode: naive AI code scanning yields true-positive rates below 7 percent, producing finding queues too noisy to act on. Mantis addresses that by treating sandboxed reproduction and patch re-attack as the actual trust boundary, not model confidence. This is the kind of infrastructure governance problem that safe agent deployment demands — and Mantis is one of the first open-source releases to operationalise it at the skill level.

Architecture: Slash Commands, Not a Monolith

Mantis ships as a collection of slash-command skill directories. Any agent runtime that supports slash commands — Gemini CLI, Antigravity CLI, the Google ADK, or equivalent frameworks — can load the skills. The orchestration layer is /mantis-meta-agent, a supervisor skill that chains the full pipeline inside a long-lived session; individual stages can also be invoked independently.

The pipeline divides across four logical phases. The learn phase builds a knowledge base before any auditing begins: /mantis-history mines version control for past security fixes, /mantis-summarize writes compact per-directory summaries, /mantis-architecture synthesizes entities and data flows into a linked Markdown knowledge base, /mantis-threat-model derives trust boundaries and attacker profiles, and /mantis-plan produces a targeted review roadmap. The find phase sweeps files against that plan (/mantis-researcher), then collapses duplicate findings (/mantis-dedupe), applies negative filter rules (/mantis-review), and drops issues that cannot survive a release build (/mantis-critic). The prove phase is where Mantis diverges most sharply from static analysis: /mantis-reproduce executes payloads inside a gVisor container or a VM with networking disabled, and /mantis-chain assembles multi-step exploit chains from individually confirmed findings — statically confirmed from their parts, not executed end to end. The fix phase applies a minimal patch (/mantis-patch), re-attacks with a variant payload to confirm the fix is not simply bypassable, scores each finding from 1 to 10 across impact, evidence, and viability (/mantis-calibrate), logs execution trajectories for future passes (/mantis-reflect), and produces a human-readable review packet (/mantis-report).

A newer skill, /mantis-advise, inverts the direction of the entire pipeline. Rather than reviewing existing code, it queries the accumulated threat model, historical bug lineages, and verified patch patterns before new code is written, with the goal of preventing the same vulnerability class from being introduced twice.

Token Efficiency: The Summary Tree

Feeding a full repository to a language model is both expensive and attention-diluting. Mantis addresses this with a hierarchical summary tree: directory-level and root-level summaries are written by /mantis-summarize and carried forward into every downstream stage. Google reports that this cuts token overhead by more than 85 percent compared to brute-force full-repository ingestion — a figure that determines whether the pipeline is economically viable to run repeatedly across large codebases.

Skill Capabilities at a Glance

Availability and Operational Constraints

The repository is live at google/mantis on GitHub under Apache 2.0. Google is explicit that Mantis is not a supported product and is not recommended for production deployment in its current form. Operationally, Google's own guidance requires running every skill in an isolated environment — a gVisor container or a VM with networking fully disabled — and mandates that a security expert verify every finding before it is filed or reported. The inter-stage contracts are published, meaning teams can wrap skills in a deterministic harness rather than depending on an LLM to orchestrate shell commands — a meaningful design choice for groups concerned about agent control and shared execution contracts.

Mantis is notable precisely because it publishes grounding as an architectural requirement rather than an afterthought: no finding advances past the prove phase without a sandbox execution result attached to it. This puts it in a different category from AI systems that have already demonstrated unsanctioned interactions with security infrastructure, where the absence of rigorous grounding mechanisms has historically been the failure point. Whether that discipline holds as teams adapt the skills to their own agent frameworks will determine whether Mantis changes how security reviews are conducted or simply adds another layer of unverified AI output to the queue.