Google Mantis vulnerability scanner: An Agentic Harness That Cuts False Positives

Google announced on Sep 6, 2026 that it has open-sourced Mantis, a vulnerability scanner that couples traditional static analysis with a purpose-built large language model (LLM) for triage. The framework discards spurious alerts before they reach developers, achieving roughly a 70% reduction in false positives while preserving coverage of critical CVEs. Early benchmarks shared by the team show that a single finding is processed in under 150 ms on a v4 TPU, making real-time feedback feasible in CI/CD pipelines.

Architecture and Model Choices

Mantis’ core consists of three layers:

  1. Static analysis front-end – integrates with open-source tools such as CodeQL and Semgrep to generate raw findings.
  2. Agentic LLM triage – a fine-tuned 7-b parameter transformer (based on the PaLM-2 family) runs on Google Cloud TPUs, evaluating each finding against code context, dependency graphs, and a curated exploit knowledge base.
  3. Feedback loop – developers approve or reject triage decisions; the system logs outcomes and periodically re-fine-tunes the model using reinforcement learning from human feedback (RLHF).

The inference pipeline is optimized for latency. A single finding costs less than 150 ms on a TPU and about 1.2 s on a CPU, allowing teams to choose hardware that matches their throughput needs. Docker images are provided for both CPU and TPU execution, and the repository includes Terraform scripts for rapid TPU provisioning.

Integration Path for Security Teams

Mantis ships with plug-ins for popular CI platforms (GitHub Actions, GitLab CI, Jenkins) and can be invoked as a step that consumes the SARIF output of any static analyzer. The harness emits a consolidated SARIF report where each finding is annotated with a confidence score and a short natural-language justification generated by the LLM. This design lets security engineers prioritize remediation without manually sifting through noisy alerts.

Operational Implications

The reduction in false positives translates directly into lower triage labor costs. A 2024 SANS survey estimated that analysts spend an average of 30 minutes per false alert; applying Mantis’ reported 70% cut could save up to 21 minutes per alert, scaling to thousands of hours for large enterprises. The agentic approach also introduces a new attack surface: the LLM itself must be protected against prompt injection and model poisoning. Google mitigates this risk by sandboxing the inference container and signing model checkpoints, but organizations should audit the supply chain of model artifacts.

Market Impact and Competitive Landscape

Mantis joins a growing cohort of AI-augmented security tools, including commercial scanners that have begun experimenting with LLM-based triage. By open-sourcing the harness, Google lowers the entry barrier for smaller teams and may force proprietary vendors to accelerate their own agentic features. The move also aligns with Google’s broader strategy of democratizing AI infrastructure, as seen in its recent push to expand the model hub for community-driven model sharing.

Regulatory and Compliance Considerations

Security tooling that leverages generative AI must navigate emerging regulations around model transparency and data provenance. The EU AI Act, for example, classifies high-risk AI systems that affect security decisions as subject to conformity assessments. Mantis’ open-source nature simplifies auditability, but enterprises deploying it in regulated sectors will still need to document model versioning, training data sources, and the rationale behind each triage decision.

What to Watch Next

Google plans to release a 30-b parameter variant of the triage model later this year. The larger model promises deeper code understanding but will increase TPU demand. Analysts should track adoption metrics on GitHub, monitor the rate of community-contributed plug-ins, and evaluate how quickly enterprises integrate the new variant into production pipelines. These signals will indicate whether the Google Mantis vulnerability scanner becomes the de-facto standard for AI-enhanced vulnerability management.

Further Reading

For a broader view of AI-driven security trends, see InfoQ’s recent analysis of automated threat detection.

How does Mantis differ from traditional static analysis?

Traditional static analysis flags potential issues based on pattern matching and data-flow heuristics, often producing large volumes of low-confidence alerts. Mantis adds an LLM-driven reasoning layer that evaluates each finding against code semantics and known exploit patterns, effectively filtering out noise before developers see the report.

Can Mantis be used with existing security pipelines?

Yes. Mantis provides adapters for SARIF, JSON, and plain-text outputs, and its CI plug-ins can be dropped into existing pipelines with minimal configuration. The harness can run on CPUs for small teams or on TPUs for high-throughput environments.

What are the hardware requirements for the LLM triage component?

The baseline 7-b model runs comfortably on a single v4 TPU, delivering sub-200 ms latency per finding. For CPU-only deployments, inference time rises to roughly 1.2 seconds per finding, which may still be acceptable for nightly scans but not for real-time PR checks.

Is the source code for Mantis publicly available?

Google has published the full codebase on GitHub under an Apache 2.0 license, including Dockerfiles, Terraform scripts for TPU provisioning, and extensive documentation for extending the framework.

What security risks does the LLM component introduce?

The LLM could be vulnerable to prompt injection if an attacker can influence the code snippet fed to the model. Google mitigates this by sanitizing inputs and isolating the inference container, but organizations should still enforce strict access controls around the scanning pipeline.

Related coverage

Explore more on this topic