Google CodeMender Evolves into Managed AI Security Agent for Enterprise
Google's CodeMender, initially a research project, is now a managed AI security agent integrated into Google Cloud, actively finding and fixing vulnerabilities by building and running exploits.
Google has transformed its advanced security research project, CodeMender, into a fully managed AI code security agent designed for enterprise use. Originally developed by Google DeepMind and introduced in October 2025, CodeMender initially focused on autonomous vulnerability discovery, debugging, and patching using Gemini reasoning models and static/dynamic code analysis. Its key innovation was not just identifying theoretical issues but generating and validating correct patches, even rewriting legacy code to preemptively eliminate vulnerability classes, successfully contributing fixes to major open-source projects.
The agent's evolution sees it move from a research tool to an integral part of Google Cloud's infrastructure. CodeMender now actively constructs and executes proof-of-concept (PoC) exploits within customer-managed sandboxes to rigorously verify the exploitability of discovered vulnerabilities. This proactive approach ensures that identified issues are not merely theoretical but represent genuine threats that organizations must address. The agent then delivers validated code differences directly to development pipelines for review, incorporating a large language model-as-a-judge mechanism to ensure these changes adhere to organizational policies and do not disrupt core business logic.
CodeMender's integration into the Gemini Enterprise Agent Platform and AI Threat Defense offers flexibility in model selection, allowing users to choose between Gemini 3.5 Flash, Gemini 3.1 Pro, or Gemini 3 Flash to balance cost, speed, and scanning depth. Google has also indicated support for third-party frontier models later this year. This multi-model approach caters to diverse enterprise needs, from rapid, cost-effective scanning to deep, comprehensive analysis.
Currently available in public preview, CodeMender integrates with developer environments via a command-line interface (CLI) and tools like VS Code and the Antigravity desktop app. It also functions as a core component of Google AI Threat Defense, collaborating with Mandiant's threat intelligence and Wiz's risk prioritization capabilities. Security and control are paramount, with features like secure traffic routing through customer Virtual Private Clouds, data isolation, encryption, and zero retention of source code data already operational.
The agent supports a wide array of major software languages, including C, C++, Go, Java, Python, Ruby, Rust, and TypeScript/JavaScript, along with popular enterprise frameworks such as Django, Flask, React, Spring Boot, and Express. A specialized, security-tuned model, Gemini 3.5 Flash Cyber, is currently in a limited-access pilot for governments and trusted partners due to its potent capabilities.
Future enhancements are planned, including deeper integration with Wiz for direct remediation orchestration and advanced enterprise governance features. These will encompass robust user registration, identity management, comprehensive observability, audit logs, and localized data residency controls, further solidifying CodeMender's role as a comprehensive enterprise security solution.
This transition marks a significant step in leveraging AI for proactive cybersecurity. By moving beyond static analysis to dynamic exploit validation and automated patching, CodeMender aims to significantly reduce the window of vulnerability for organizations, enabling them to test and strengthen their defenses against sophisticated, real-world attack scenarios.