TL;DR
Google open-sourced Mantis Skills, a modular toolkit for autonomous AI-assisted vulnerability discovery and patching across codebases, hardware, and infrastructure.
Key Points
- 15-stage pipeline with supervisor agent orchestrating security review, deduplication, validation, PoC generation, and patch automation
- Supports diverse targets: source code, compiled binaries, RTL/hardware designs, IaC (Terraform/Kubernetes), ML pipelines, and custom test environments
- Explicit isolation requirements: Docker/gVisor sandboxing, interactive human-in-the-loop mode, and mandatory unattended deployment hardening to prevent production impact
- Continuous learning loop with historical vulnerability tracking (learnings.jsonl) and adaptive threat modeling across iterative runs
Why It Matters
This enables security teams to systematically audit large codebases at scale using AI agents while maintaining strict isolation boundaries—critical for organizations adopting agentic security tools. The modular design and emphasis on false-positive filtering makes it practical for production use, though the explicit warnings about AI non-determinism and sandbox escapes underscore the need for careful deployment.
Source: github.com