Industry story
Google Cloud Deploys Internal Multi-Agent Security Framework 'Mantis' for Autonomous SDLC
Google just showed the gap between "we use AI for security" and what that actually looks like at scale. Mantis is a five-role agent hierarchy — Strategist, Researcher, Deduplicator, Reviewer, Critic — that cuts token overhead by over 85% and runs a reproduction sandbox to verify exploitability before a human ever sees an alert, because naive AI code scanning tops out at a 7% true-positive rate and nobody has time for that. The self-reflection loop is the part worth watching: successful agent trajectories get written to a shared knowledge store and injected into future context windows, meaning the system compounds its own judgment over time. That's not a security tool — that's an autonomous security organization.
Full analysis
Google Cloud's CISO and security engineering team have detailed how they use a multi-agent AI orchestration framework called Mantis — now partially open-sourced — to automate security across the entire software development lifecycle (SDLC). Mantis uses a hierarchy of specialized agents (Strategist, Research, Deduplicator, Reviewer, Critic) to scan code repositories and reduces token processing overhead by over 85% via a hierarchical security summary tree, while a reproduction sandbox automatically verifies real-world exploitability of flagged vulnerabilities before alerting developers. The team says naive decentralized AI code scanning yields true-positive rates under 7%, a problem Mantis is designed to solve through coordinated multi-agent workflows.
Beyond code scanning, Google Cloud describes autonomous fuzz-testing pipelines with self-healing capabilities (a Hallucination Cleaner agent repairs broken dependencies), a four-step autonomous patching pipeline (Reproduce → Bug Context → Patch → Evaluation agents), and a post-launch autonomous security posture management (ASPM) system that detects configuration drift and triggers remediation. A 'self-reflection loop' persists successful agent trajectories into a shared knowledge store, injecting lessons into future agent context windows to compound improvements over time. Google describes this as a shift toward 'immune software' that continuously discovers, validates, and patches its own weaknesses.
Comments