Google Cloud Deploys Internal Multi-Agent Security Framework 'Mantis' for Autonomous SDLC

Full analysis

Google Cloud's CISO and security engineering team have detailed how they use a multi-agent AI orchestration framework called Mantis — now partially open-sourced — to automate security across the entire software development lifecycle (SDLC). Mantis uses a hierarchy of specialized agents (Strategist, Research, Deduplicator, Reviewer, Critic) to scan code repositories and reduces token processing overhead by over 85% via a hierarchical security summary tree, while a reproduction sandbox automatically verifies real-world exploitability of flagged vulnerabilities before alerting developers. The team says naive decentralized AI code scanning yields true-positive rates under 7%, a problem Mantis is designed to solve through coordinated multi-agent workflows.

Beyond code scanning, Google Cloud describes autonomous fuzz-testing pipelines with self-healing capabilities (a Hallucination Cleaner agent repairs broken dependencies), a four-step autonomous patching pipeline (Reproduce → Bug Context → Patch → Evaluation agents), and a post-launch autonomous security posture management (ASPM) system that detects configuration drift and triggers remediation. A 'self-reflection loop' persists successful agent trajectories into a shared knowledge store, injecting lessons into future agent context windows to compound improvements over time. Google describes this as a shift toward 'immune software' that continuously discovers, validates, and patches its own weaknesses.