Google Cloud has made CodeMender, an autonomous AI code security agent developed with Google DeepMind, available in public preview on the Gemini Enterprise Agent Platform. The tool is designed to scan software codebases, verify discovered security flaws through simulated exploits in isolated sandboxes, and automatically generate tested code patches.
CodeMender represents an operational shift from passive static analysis to autonomous remediation. Rather than delivering raw alerts to developers, the system pairs multi-model vulnerability discovery with executable exploit validation to eliminate false positives before presenting remediations.
Architecture and Core Workflow
CodeMender functions through a fine-tuned harness maintained and updated by Google DeepMind. The agent executes a three-stage pipeline across source repositories:
- Multi-Model Scanning: CodeMender evaluates repository architecture, data paths, and semantic context across supported languages, including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. The scanning engine targets memory corruption, injection vulnerabilities, cryptographic misconfigurations, and improper data handling.
- Exploit Simulation and Verification: To filter out theoretical or non-exploitable findings, CodeMender constructs targeted proof-of-concept exploits. It runs these test cases within an isolated, customer-managed sandbox environment. If an exploit succeeds in reproducing the vulnerability, the issue is flagged as a validated high-priority risk.
- Automated Patch Generation and Review: For confirmed vulnerabilities, CodeMender writes targeted code patches that conform to the existing repository style guidelines. An LLM-as-a-judge validation step evaluates the patch to prevent functional regressions before submitting the change as a standard Git diff for developer review and approval.
Enterprise Integration and Security Boundaries
CodeMender operates within customer-managed virtual private clouds (VPCs) under enterprise governance policies. Source code and generated artifacts are processed with data isolation, encryption, and zero-retention guarantees.
Developers can interact with CodeMender via a lightweight CLI client, within IDEs such as VS Code, or integrated directly into CI/CD build pipelines. Additionally, Google Cloud is integrating CodeMender into its AI Threat Defense suite in collaboration with cloud security firm Wiz. In this deployment mode, Wiz Security Graph context triggers CodeMender scans and coordinates with Wiz Red and Green agents to orchestrate vulnerability validation and patching workflows.
Model Availability
In its public preview, CodeMender supports generally available Gemini models, allowing organizations to configure model selection based on throughput, token costs, and scanning depth. Google Cloud announced plans to add third-party frontier model options later this year.
A specialized variant powered by Gemini 3.5 Flash Cyber will remain restricted to select government agencies and trusted security partners before broader rollout.
