ReleaseBytes
gcp Google Cloud Blog ·

Google Enhances SDLC Security with AI Agents; Open Sources Mantis

blogaiengineergovernment
announcement

Google has implemented an AI-native agentic security system to embed continuous vulnerability scanning and patching directly into its software development lifecycle. This system prevents hundreds of vulnerabilities monthly by evaluating code changes in real-time, significantly improving security posture and efficiency. To enable other organizations to adopt similar practices, Google is now making Mantis, its multi-agent review harness used in the system, available as open source. The solution features localized threat models, specialized triage agents with high precision, and automated bug-fix agents to accelerate detection and resolution.

  • →Mantis Multi-Agent Review Harness Open Sourced
  • →Real-time Pre-Submit Scanning with AI Agents
  • →High-Precision Scanning with Localized Threat Models
  • →Specialized Triage Agents for Rapid Vulnerability Validation
  • →Automated Bug Fix Agents Close the Loop
Features (1) ›
  • Mantis Multi-Agent Review Harness Open Sourced

    Google has open-sourced Mantis, its multi-agent review harness that forms a critical part of this internal security system. This enables other organizations to adopt similar AI-native security transformations and benefit from its capabilities.

Notes (4) ›
  • Real-time Pre-Submit Scanning with AI Agents

    Google embeds high-precision vulnerability scanning directly into its software development lifecycle by evaluating each code check-in in real-time using AI agents. This continuous process integrates security into developer workflows, similar to other code reviews.

  • High-Precision Scanning with Localized Threat Models

    The system utilizes evolved localized threat models, matching security agents with live codebase metadata and dependence call graphs. This approach significantly improves scanning accuracy, reducing false-positive rates to 3% in some cases.

  • Specialized Triage Agents for Rapid Vulnerability Validation

    A two-step validation process employs specialized triage agents to programmatically check code structure for reachable vulnerable paths. These agents achieve over 92% precision and complete their work in under a minute, ensuring low-latency responses.

  • Automated Bug Fix Agents Close the Loop

    The solution includes automated bug-fix agents that construct precise fixes based on scan results and proofs. These fixes are submitted for human review as part of the original change request, accelerating resolution time.

Read the original announcement →

https://cloud.google.com/blog/topics/systems/using-ai-agents-to-secure-google-infrastructure/

Related releases