What Happened
Google released Mantis, an open-source vulnerability discovery and patching harness designed to automate security analysis across software repositories. Mantis combines agentic review techniques with sandboxed reproduction of vulnerabilities, aiming to reduce hallucinated findings and improve true-positive filtering in a category where naive AI scanners can have true-positive rates below 7% [1].
The system analyzes repository history to generate architectural and threat-model documentation, then builds a hierarchical security-summary tree to preserve structural context while reducing token overhead by more than 85% [1]. It also includes guidance for secure-code assistance through a mantis-advise skill, curated context, sandboxed execution, and explicit vulnerability-acceptance criteria [1].
In parallel, Google Cloud expanded its enterprise AI platform around Gemini, Vertex AI evolution through the Gemini Enterprise Agent Platform, and infrastructure for large-scale agent workloads. Announcements included Agent Runtime, Agent Identity, Agent Designer, Managed Agents API, Inbox, Skills and Canvas, plus new Gemini model variants, multimodal capabilities, embeddings, and industry-focused agent deployments [2].
The platform direction is clear: enterprise AI is moving from isolated model APIs toward managed agent runtimes, identity-aware execution, cross-cloud data access, security controls, FinOps tooling, and specialized accelerators such as TPU 8t and TPU 8i for large-scale training and inference [2].
Why It Matters to Businesses
AI adoption is no longer just a model-selection problem. For production teams, the hard questions are now operational:
- How do we give agents access to tools and data without creating uncontrolled privilege escalation?
- How do we keep inference, orchestration and evaluation costs predictable as usage grows?
- How do we verify model-generated code, security findings and remediation suggestions before they reach production?
- How do we preserve context across large repositories, documents and business systems without exploding token spend?
- How do we run agents long enough to complete meaningful work while maintaining auditability and human control?
Mantis addresses one production bottleneck: AI systems that produce plausible but unverified security findings. Its emphasis on sandboxed reproduction and acceptance criteria reflects a broader lesson for enterprise AI: the model should propose; deterministic systems should verify [1].
Google Cloud’s platform announcements address the other side of the equation: the infrastructure required to run agentic applications at enterprise scale. Agent identity, managed runtimes, security gateways, model protection, cross-cloud data access, cost controls and accelerator choices are becoming first-class architecture decisions rather than add-ons [2].
For business leaders, the implication is practical. The fastest path to value is not building a one-off chatbot. It is building a controlled AI application platform: reusable identity, data, evaluation, observability, policy and cost-management layers that multiple AI use cases can share.
Kimbodo Engineering Perspective
Most enterprise AI failures we see are not caused by weak model demos. They are caused by missing production boundaries: unclear ownership of tool permissions, no evaluation harness, no spend guardrails, weak logging, poor data-context design, and no safe rollback path.
The Mantis approach is important because it treats AI-generated security work as an evidence pipeline, not a text-generation task. An agent can search, reason and propose, but the system still needs sandboxed reproduction, version-controlled patches, review agents, deterministic tests and explicit acceptance thresholds [1]. That is the pattern teams should copy for other high-risk workflows such as financial analysis, claims handling, procurement approvals and infrastructure automation.
The Google Cloud platform direction also reflects a real market shift. Enterprises want managed agent runtimes, identity-aware tool use, long-running workflows and integrated spend controls instead of hand-rolled orchestration glued together with scripts [2]. The trade-off is platform dependency. Managed services can accelerate delivery and reduce operational burden, but architecture teams should avoid embedding business logic so deeply into one vendor’s abstractions that portability, testing and future negotiation leverage disappear.
Key Architecture Trade-Offs
- Managed agent platform versus custom orchestration: Managed platforms reduce time to production for identity, runtime, observability and scaling. Custom orchestration provides more control, portability and vendor flexibility.
- Large context windows versus structured retrieval: Bigger model contexts are useful, but hierarchical summaries, indexes and curated retrieval often produce lower cost and better control. Mantis’ summary tree is a good example of compressing context without losing structure [1].
- Agent autonomy versus approval gates: Long-running agents can complete complex work, but production systems need policy checks, human approval, scoped credentials and reversible actions.
- GPU/TPU scale versus workload efficiency: Specialized accelerators can reduce unit economics at scale, but only when utilization, batching, routing and model selection are engineered properly [2].
- Security scanning versus verified remediation: Finding issues is cheaper than proving them. Systems that reproduce bugs in sandboxes and validate patches are more expensive to build but produce more trustworthy outcomes [1].
How We Would Implement It
For a business building production AI agents or AI-assisted software engineering systems, we would implement the platform in layers rather than as a monolithic agent application.
1. Establish the AI Application Control Plane
- Create a central registry for models, tools, prompts, policies, datasets, evaluations and approved agent capabilities.
- Use identity-aware execution for every agent action. Agents should not share broad service accounts; each workflow should receive scoped, auditable permissions.
- Separate development, staging and production agent environments, including isolated sandboxes for code execution and security testing.
- Define deployment gates for prompt changes, model upgrades, tool integrations and permission changes.
2. Design Context as Infrastructure
- Build retrieval pipelines over source code, tickets, documentation, runbooks, data catalogs and security policies.
- Use hierarchical summarization for large repositories and document collections, similar to Mantis’ approach to reducing token overhead while preserving structural context [1].
- Store embeddings, metadata and document lineage so retrieved context is explainable and auditable.
- Implement context budgets by workflow type. A code-review agent, customer-support agent and finance agent should not use the same retrieval strategy.
3. Add Verification Before Automation
- For code and security agents, run proposed changes in ephemeral sandboxes with unit tests, integration tests, static analysis and exploit reproduction where applicable.
- Require explicit acceptance criteria for high-risk findings, as recommended by Mantis [1].
- Use critic or reviewer agents, but do not rely on them alone. Pair them with deterministic checks, policy engines and human approval for material changes.
- Generate evidence packages: original issue, retrieved context, reasoning trace where appropriate, test output, patch diff, reviewer result and final approval.
4. Engineer for Cost Control From Day One
- Route requests by complexity: small models for classification and extraction, larger models for reasoning-heavy workflows, and specialist models for code or multimodal tasks.
- Use caching for repeated retrieval, prompt prefixes, embeddings and deterministic tool outputs.
- Set budgets by team, application, tenant and workflow class. Google Cloud’s expanded FinOps and spend controls for agent workloads reflect a necessary production requirement, not an optional feature [2].
- Monitor cost per successful task, not just cost per token. A cheap model that requires repeated retries may be more expensive operationally than a stronger model.
- Evaluate accelerator options only after measuring steady-state demand, latency requirements, batching potential and utilization. TPU or GPU commitments make sense for sustained workloads, not sporadic experiments.
5. Deploy With Observability and Incident Response
- Log agent plans, tool calls, retrieved context identifiers, model versions, policy decisions and final outputs.
- Track hallucination rate, tool failure rate, escalation rate, acceptance rate, latency, cost per workflow and user correction rate.
- Create incident runbooks for prompt injection, data leakage, runaway tool use, excessive spend, unsafe code generation and model regression.
- Use security controls such as model protection, agent gateways, identity policies and cloud security monitoring where available [2].
Risks, Costs and Security
The main risk in enterprise agent platforms is over-delegation. Giving an agent tool access, business context and long-running execution without strong identity, policy and verification creates operational and security exposure. Agent identity and gateway patterns are becoming essential because tool use is where business risk materializes [2].
Security teams should treat AI agents as semi-autonomous software operators. That means least privilege, network restrictions, secret isolation, sandboxed execution, tamper-resistant logs, data-loss controls and mandatory review for sensitive actions. For code and vulnerability workflows, sandboxed reproduction and patch validation are especially important because AI-generated findings can otherwise waste engineering time or create false confidence [1].
Costs can also scale unpredictably. Long-running agents, large context windows, multimodal inputs and repeated retries can turn a successful pilot into an expensive production workload. Effective platforms need usage quotas, cost attribution, model routing, caching, batching and workload-specific budgets. FinOps must be part of the architecture, not a finance report after deployment [2].
The strongest architecture is usually hybrid: managed cloud AI services for runtime, identity, model access and observability where they reduce undifferentiated work; custom evaluation, policy, context engineering and workflow logic where they protect business-specific value. That balance gives enterprises speed without surrendering control over security posture, cost structure or application behavior.
For teams building AI-powered systems, the production lesson is straightforward: build the platform before scaling the agents. The winners will not be the companies with the most demos. They will be the companies with repeatable AI delivery pipelines, verified outputs, governed tool access and measurable unit economics.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Infrastructure & MLOps practice, or Estimate My Infrastructure.
