Google Releases Mantis Framework to Automate Vulnerability Discovery and Remediation

Google has released an open-source framework called Mantis that leverages AI to automate vulnerability discovery and remediation in software. The initiative aims to enable the defensive side to harness AI's capabilities in identifying vulnerabilities in source code. According to Google, traditional low-precision AI code scanning can produce hallucinations, reporting vulnerabilities that don't actually exist.

Mantis employs a mechanism that reduces false positives by layering verification through multiple AI agents after initial candidate discovery. The framework examines the repository's change history and gathers information from previously patched vulnerabilities and security issues before beginning analysis.

The approach enables large-scale software analysis while minimizing processing overhead, reducing token counts by more than 85% according to Google. Mantis can be used with various tools, including Gemini CLI and Antigravity CLI, and provides 'mantis-advise,' which applies previously discovered vulnerabilities and remediation approaches to guide development.

Google also announced the release of 'Gemini 3.8 Flash Cyber,' an AI model specialized for security domain that identified more vulnerabilities and generated working patches more frequently than previous models in internal testing.