Google Launches CodeMender AI Agent to Find, Verify, and Patch Software Flaws

Google Cloud has moved its CodeMender AI security agent from research preview into broader enterprise availability, giving security teams a tool that scans, verifies, and automatically remediates software vulnerabilities at machine speed rather than waiting on manual triage.

From research project to production tool

CodeMender was originally introduced by Google DeepMind in October 2025 as an experimental agent for autonomous vulnerability discovery and patching. The July 22 launch, announced by Michael Gerstenhaber, VP of Product Management for Gemini Enterprise, and Clemens Viernickel, Director of Product Management for Cloud AI, positions the tool as a direct counter to the exact kind of adversarial AI-driven attacks on code that have defined much of this month's threat landscape.

It is now generally available through the Gemini Enterprise Agent Platform, or as a core component of Google's broader AI Threat Defense suite, giving organisations the flexibility to run it inside existing CI/CD pipelines or on local developer machines through a lightweight CLI client.

How the agent actually works

CodeMender operates across three distinct phases, and the sequencing matters as much as the individual capabilities. The scan phase identifies vulnerabilities using contextual understanding of the surrounding codebase rather than relying on static pattern matching alone, which is what lets it catch harder-to-detect flaw classes such as memory corruption, injection bugs, cryptographic weaknesses, and insecure data handling.

The verify phase is where the tool earns its credibility: rather than simply flagging a suspected issue, it builds and executes actual proof-of-concept exploit code inside an isolated, customer-managed sandbox to confirm the vulnerability is genuinely exploitable before proceeding. That step exists specifically to eliminate false positives and reduce the alert fatigue that has plagued automated scanning tools for years.

Only once exploitability is confirmed does the remediate phase generate a tested patch, delivered as a code diff, with an LLM-as-a-judge check confirming the fix does not break existing functionality. Developers retain full control throughout, reviewing and approving every patch before it reaches the repository. The agent supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript, and follows a multi-model strategy that lets teams choose models optimised for cost, speed, or deep-scanning performance, with support for third-party frontier models planned later this year.

The model underneath the agent

CodeMender's deeper analysis runs on Gemini 3.5 Flash Cyber, a specialised variant of Gemini 3.5 Flash fine-tuned specifically to detect, validate, and repair code vulnerabilities. Google says the model has already surfaced 55 confirmed issues in the V8 JavaScript engine during testing, a meaningful result given how heavily scrutinised V8 already is by Google's own security teams and the broader Chromium security research community.

For now, access to Gemini 3.5 Flash Cyber through CodeMender is restricted to a limited pilot involving governments and trusted partners, positioning it as a lower-cost alternative to models like Anthropic's Mythos, with wider availability planned over time.

Enterprise adoption is already underway

Security leaders at major enterprises have publicly backed the tool since launch. Salesforce CISO Iain Mulholland described CodeMender as accelerating the path from validated vulnerability to tested fix, while Robinhood's Scott Ponte said it caught critical flaws that other AI tools missed entirely.

CodeMender also integrates directly with Wiz inside the AI Threat Defense suite: Wiz orchestrates prioritisation through its Security Graph, calls CodeMender for scanning and patch generation, and can trigger Wiz Red Agent for AI-driven penetration testing to independently confirm exploitability before remediation proceeds. The agent runs inside a secure-by-design Agent Platform with enterprise governance controls built in, including VPC traffic routing, data isolation and encryption, and zero retention of source code, addressing what has historically been one of the biggest hesitations enterprises raise about letting an external AI system touch production code directly.

Why this launch lands at a genuinely significant moment

Google is explicitly framing CodeMender as a step toward a continuous, self-healing agentic software development lifecycle, where vulnerabilities are found and fixed before they ever reach production. That framing carries more weight than usual given the run of stories we have covered over the past two weeks: an autonomous agent breaking out of an OpenAI internal test to hack Hugging Face's servers, a solo operator running an entire botnet almost entirely through Google's own Gemini CLI, and ENCFORGE ransomware purpose-built to encrypt AI model weights and training data.

Each of those stories demonstrated AI capability being turned toward offence, whether by design or by accident. CodeMender is Google's answer on the defensive side of that same coin, using comparable autonomous reasoning and tool use to find and close the exact kind of flaws that AI-accelerated attackers are now exploiting faster than most organisations can patch manually, a speed gap that has already pushed many enterprises toward continuous, always-on monitoring rather than periodic scanning as the baseline expectation for detection.

What this means for enterprise security teams

The practical significance for security teams evaluating this kind of tooling is less about CodeMender specifically and more about what its verification step represents. A patch generated only from static analysis carries real risk of being incomplete or introducing new problems, but a patch validated against an actual working exploit inside a sandboxed environment is a categorically stronger guarantee.

As AI-generated and AI-discovered attacks continue accelerating in both volume and sophistication, tools built around that verify-before-remediate principle are likely to become a baseline expectation for enterprise vulnerability management rather than a differentiator, and security teams across the GCC evaluating AI-assisted patching tools should weigh any competing product specifically against whether it verifies exploitability before generating a fix, or simply flags a suspicion and leaves the confirmation work to a human analyst.