Google's Mantis framework cuts token overhead by 85% in large repositories

Google released details on September 2, 2026, of Mantis, an open-source framework that automates vulnerability discovery, reproduction, and fixing using AI, reducing token overhead by over 85% even in large repositories. Mantis uses multiple AI agents to verify candidates, reducing false positives from initial scans that can have true positive rates below 7%. It builds threat models from repository history and code structure, then reproduces vulnerabilities in sandboxes before generating fixes. The framework uses hierarchical security summaries to manage large codebases efficiently. Google recommends human verification of AI outputs and running generated code in isolated environments, while providing proper context and clear vulnerability criteria to maximize effectiveness.