Google Reveals Details of Mantis, an Open-Source Framework Automating Vulnerability Discovery to Remediation

AI models are increasingly capable of finding vulnerabilities in source code and determining whether they can be actively exploited. According to Google, AI models have demonstrated the ability to discover and exploit vulnerabilities with minimal human assistance.

Mantis employs a system that reduces false positives by utilizing multiple AI agents to perform iterative verification. After searching for potential vulnerabilities, reviewer and validator agents verify the conditions required for the issue to exist and reproduce the vulnerability within an isolated sandbox environment. Once a problem is confirmed, the process proceeds to the creation of fix code.

Additionally, Mantis examines the repository's change history before analysis to gather information from past fixes. It automatically constructs documentation, such as "threat models," by analyzing the source code to organize its structure and summarize potential attack vectors.

For the analysis of large-scale software, Mantis adopts a method of creating hierarchical security summaries, where information from individual files is aggregated by directory and then rolled up into a summary of the entire repository. Google stated that this approach reduces token overhead by over 85% while maintaining critical structural information.

On the other hand, Google noted that AI-generated vulnerability reports and fix codes are not always correct, and therefore requires manual verification by security experts. Furthermore, Google stated that AI-generated code should be executed in environments isolated from production systems.