Google's Mantis Toolkit Automates Vulnerability Patching

Google published Mantis on GitHub this week, a toolkit that hands an AI coding agent the entire job of hunting software vulnerabilities, not just spotting them. The pitch is narrow but ambitious: instead of a scanner that flags suspicious code and quits, Mantis chains together a set of skills that find a bug, confirm it actually works by reproducing it in a sandbox, write a patch, then attack that patch to see if it holds.

It runs as slash commands inside an agent framework you already have, things like Gemini CLI, Antigravity CLI, or the Google ADK. There's no standalone Mantis server or hosted service. You clone the repository, load the skill set into your agent, and the agent does the work under a strict set of execution rules Google built in to keep it from running arbitrary code outside approved boundaries.

Google is explicit that this is a local and internal evaluation tool right now, not something ready for production pipelines. The interesting part isn't the individual scanning step, it's how Mantis breaks the vulnerability lifecycle into discrete, chainable stages that an agent can move through on its own.