AI can now discover and exploit software vulnerabilities autonomously. To combat this, Google developed Mantis, an open-source framework that automates vulnerability discovery, triage, reproduction, and patching. Mantis aims to provide defenders with an AI advantage by enabling machine-speed security analysis. Unlike other AI tools that suffer from low true-positive rates, Mantis employs agentic techniques and sandboxed vulnerability reproduction for accuracy. It learns from past security fixes within a repository to build architectural and threat model documentation. Mantis condenses large codebases into a hierarchical security summary tree, significantly reducing token overhead. The framework distills extensive cybersecurity knowledge and is available on GitHub. Users can clone Mantis locally and then prompt a coding agent to initiate code review and vulnerability analysis. Internally at Google, this approach has successfully identified real vulnerabilities. Mantis provides sample sandboxing options and allows for custom sandbox implementations. It offers a straightforward way to begin with vulnerability discovery, filtering, and patching. The mantis-advise skill further leverages accumulated knowledge for writing secure code from the outset. To maximize AI-driven vulnerability discovery, it's recommended to provide tools with context and build cyber sandboxes with clear vulnerability acceptance criteria.