Google published Mantis on 3 September, releasing as an open-source framework the harness it says is part of its internal approach to finding and fixing vulnerabilities at machine speed. Mantis automates discovery, triage, reproduction and patching, combining critic and review agents with sandboxed reproduction to ground its findings.
The sentence being misread
Google's post says: "While sloppiness in AI code scanning frequently leads to hallucinated bugs and weak true-positive rates under 7%, we designed Mantis to be effective by combining industry-standard agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities for grounding." That number describes the state of the field Google is positioning against. It is the problem statement, not the product's score.
What the common framing gets wrong
Within hours the 7% figure was circulating as Mantis's own true-positive rate, which inverts the claim entirely — turning a criticism of competing approaches into an admission about Google's tool. The harder point, and the one worth making: the post gives Mantis no accuracy figure at all. No true-positive rate, no benchmark result, no comparison table. A reader gets a described architecture and an assertion of effectiveness. The unsourced 7% is doing the evidentiary work in coverage precisely because there is no measured number to quote instead.
Why grounding is the design claim
The architecture is the substantive disclosure. Hallucinated vulnerability reports are the failure mode that has made AI code scanners a burden on maintainers — every false positive costs human triage time, and open-source projects have begun rejecting AI-generated reports outright. Mantis's answer is sandboxed reproduction: a finding is only a finding if the harness can trigger it. That is the correct architectural response, and it is checkable by anyone who runs the code, which is the advantage of shipping it open source.
What is missing
The post does not state a licence. For an open-source release aimed at maintainers and critical-infrastructure operators, the licence is not a detail — it determines who can use the harness commercially and under what terms. Anyone planning to adopt it should read the repository, not the announcement.