Google’s Mantis addresses the biggest frustration teams face when relying on AI coding agents for security: the flood of unverified findings that waste time and create false confidence. Instead of a black‑box scanner that spits out alerts and disappears, Mantis is a collection of slash‑command skills that an existing agent can load and run in a controlled loop. The process starts with learning the codebase – mining past fixes, mapping directories, building a threat model, and planning a focused review. Next, the agent sweeps the relevant files, removes duplicates, applies negative rules, and discards issues that cannot survive a release build. The core of Mantis is the reproducible stage: each candidate flaw is executed in a sandbox with networking disabled, confirming whether the bug can actually be triggered. If confirmed, the agent assembles exploit chains, applies a minimal patch, re‑attacks the fix, and scores the remaining risk on a 1‑10 scale. Learnings are written back so the same mistake does not reappear, and a concise report is produced for human reviewers. Because each stage publishes a clear contract, teams can wrap the skills in a deterministic harness instead of trusting the LLM to orchestrate shell commands. Mantis is released under Apache 2.0 and can be tried locally with Gemini CLI, Antigravity CLI, the Google ADK, or any comparable framework, though it is not yet recommended for production workloads. By grounding every finding in a sandboxed re‑attack and cutting token overhead with a hierarchical summary tree, Mantis turns noisy AI output into actionable, trusted security insights. #AI #Product #DevSecOps #MLOps #Security #OpenSource