Google has introduced CodeMender, a new AI-powered code security agent designed to find, validate automatically, and patch vulnerabilities at machine speed, as organizations face a surge in AI-driven cyber threats targeting software supply chains.
The launch marks a shift from traditional vulnerability scanning toward autonomous remediation, where security tools not only detect flaws but also verify exploitability and generate tested fixes.
CodeMender is currently available in preview and integrates with Google’s Gemini Enterprise Agent Platform, while also functioning as a core component of its broader AI Threat Defense ecosystem.
Built on research from Google DeepMind, CodeMender aims to eliminate the long-standing bottleneck between vulnerability discovery and remediation.
Instead of relying on manual triage and patching, the agent automates the entire lifecycle. It scans source code for security flaws, simulates real-world attacks to confirm exploitability, and produces validated patches that developers can review before deployment.
Google Launches CodeMender AI Agent
CodeMender prioritizes real-world risk by generating proof-of-concept exploits in isolated sandboxes to verify exploitability, reducing false positives and helping security teams focus on high-impact vulnerabilities.
The platform supports multiple programming languages, including C, C++, Go, Java, Python, Rust, and TypeScript. It is designed to detect complex vulnerability classes such as memory corruption, injection flaws, cryptographic weaknesses, and insecure data handling.
By leveraging contextual understanding of applications, CodeMender can identify issues that traditional static analysis tools often miss. Once a vulnerability is verified, the agent automatically generates a secure patch and delivers it as a code diff within developer workflows.
These fixes are tested to ensure they do not break application functionality, using a validation approach where AI models assess the reliability and safety of generated patches.
Developers remain in control, with final approval required before any changes are committed. CodeMender is designed to integrate seamlessly into existing development pipelines.
It can operate within CI/CD workflows or run locally through a command-line interface, connecting to repositories and development tools such as Visual Studio Code.
Security controls include VPC-based traffic routing, encryption, and zero retention of source code, addressing concerns around sensitive data exposure.
Google is aligning CodeMender with a multi-model strategy, enabling organizations to choose AI models based on performance, cost, or analysis depth, with support for third-party frontier models coming later this year.
When deployed within AI Threat Defense, CodeMender works alongside tools like Wiz to correlate vulnerabilities with runtime context and trigger automated penetration testing. This integration enables organizations to validate risks and accelerate remediation across complex cloud environments.
Early adopters report improved detection accuracy and faster remediation cycles, with the tool identifying critical vulnerabilities missed by other AI-based solutions and delivering targeted fixes without disrupting business logic.
With CodeMender, Google is pushing toward a self-healing software development lifecycle, where vulnerabilities are continuously identified, verified, and resolved before reaching production.
As adversarial AI continues to accelerate attack capabilities, such autonomous defense systems are expected to play a critical role in securing modern applications.
