llms.blog
AI

Google Previews CodeMender: DeepMind-Engineered AI Agent for Automated Vulnerability Remediation

Google Cloud has made CodeMender, an autonomous AI code security agent developed with Google DeepMind, available in public preview on the Gemini Enterprise Agent Platform. The tool is designed to scan software codebases, verify discovered security flaws through simulated exploits in isolated sandboxes, and automatically generate tested code patches. CodeMender represents an operational shift from passive static analysis to autonomous remediation. Rather than delivering raw alerts to developers,

axc
axc
2 min
Google Previews CodeMender: DeepMind-Engineered AI Agent for Automated Vulnerability Remediation

Google Cloud has made CodeMender, an autonomous AI code security agent developed with Google DeepMind, available in public preview on the Gemini Enterprise Agent Platform. The tool is designed to scan software codebases, verify discovered security flaws through simulated exploits in isolated sandboxes, and automatically generate tested code patches.

CodeMender represents an operational shift from passive static analysis to autonomous remediation. Rather than delivering raw alerts to developers, the system pairs multi-model vulnerability discovery with executable exploit validation to eliminate false positives before presenting remediations.

Architecture and Core Workflow

CodeMender functions through a fine-tuned harness maintained and updated by Google DeepMind. The agent executes a three-stage pipeline across source repositories:

  1. Multi-Model Scanning: CodeMender evaluates repository architecture, data paths, and semantic context across supported languages, including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. The scanning engine targets memory corruption, injection vulnerabilities, cryptographic misconfigurations, and improper data handling.
  2. Exploit Simulation and Verification: To filter out theoretical or non-exploitable findings, CodeMender constructs targeted proof-of-concept exploits. It runs these test cases within an isolated, customer-managed sandbox environment. If an exploit succeeds in reproducing the vulnerability, the issue is flagged as a validated high-priority risk.
  3. Automated Patch Generation and Review: For confirmed vulnerabilities, CodeMender writes targeted code patches that conform to the existing repository style guidelines. An LLM-as-a-judge validation step evaluates the patch to prevent functional regressions before submitting the change as a standard Git diff for developer review and approval.
CodeMender Autonomous Security Pipeline

Enterprise Integration and Security Boundaries

CodeMender operates within customer-managed virtual private clouds (VPCs) under enterprise governance policies. Source code and generated artifacts are processed with data isolation, encryption, and zero-retention guarantees.

Developers can interact with CodeMender via a lightweight CLI client, within IDEs such as VS Code, or integrated directly into CI/CD build pipelines. Additionally, Google Cloud is integrating CodeMender into its AI Threat Defense suite in collaboration with cloud security firm Wiz. In this deployment mode, Wiz Security Graph context triggers CodeMender scans and coordinates with Wiz Red and Green agents to orchestrate vulnerability validation and patching workflows.

Model Availability

In its public preview, CodeMender supports generally available Gemini models, allowing organizations to configure model selection based on throughput, token costs, and scanning depth. Google Cloud announced plans to add third-party frontier model options later this year.

A specialized variant powered by Gemini 3.5 Flash Cyber will remain restricted to select government agencies and trusted security partners before broader rollout.

Sources

AICybersecurityGoogleSoftware Development
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Prefix-Tree KV Cache Management in Production: RadixAttention, Tree-Structured LRU Eviction, and Token-Level Sharing in SGLang and vLLM

    Prefix-Tree KV Cache Management in Production: RadixAttention, Tree-Structured LRU Eviction, and Token-Level Sharing in SGLang and vLLM Autoregressive large language model inference is heavily constrained by memory bandwidth and the computational overhead of the prefill phase. For workloads such as multi-turn conversations, autonomous agent tool loops, few-shot prompt evaluations, and tree-search decoding, consecutive requests often share substantial token prefixes. In a standard multi-turn ses

    1 min

  • Neural Collapse: How Simplex Equiangular Tight Frames Emerge at the Terminal Phase of Training

    In classification tasks, deep neural networks exhibit an unexpected geometric simplicity during late-stage optimization. While the internal activations of early training appear high-dimensional and complex, the penultimate layer representations and linear classifiers converge toward an exact, symmetrical geometric structure known as Neural Collapse (NC). First identified empirically by Papyan, Han, and Donoho (2020), Neural Collapse emerges during the Terminal Phase of Training (TPT). This regi

    1 min

  • Inherent Releases Faraday: 27B Scientific Agent Outperforms Frontier Models on Paper Replication

    London-based AI research startup Inherent has released Faraday, an autonomous AI agent engineered to independently reproduce published scientific research without prior exposure to target solutions. Founded by former Google DeepMind researchers Louis Kirsch, Kaloyan Aleksiev, Tantum Collins, and Edward Hughes, the lab launched Faraday weeks after securing a $50 million seed round. According to benchmark results published by the lab, Faraday outperformed significantly larger frontier systems, in

    1 min