codemender: Google's AI Agent for Code Security, Explained

The codemender story got a significant update at the Google Cloud Security Summit on November 4: Google's autonomous code-security agent, in preview since July, now isolates its vulnerability verification and exploit simulation inside sandboxes or virtual machines, adds human-in-the-loop checks for local writes, and can scan only the files that changed since the last run. For teams watching agentic AppSec, this is the moment CodeMender shifted from a promising demo to something shaped like an enterprise control. This post covers what the agent is, what the November update changes, how the validation machinery works under the hood, and where it fits in a real AppSec stack. Source

What CodeMender is

CodeMender is Google's AI agent for finding and fixing code vulnerabilities. Google Cloud hosts and manages it as a code security agent on the Gemini platform with built-in governance and developer tool integrations, offering multi-model flexibility so teams can optimize for cost, speed, or deep coding performance. The pitch has three parts: automated remediation to eliminate manual verification and patching, prioritization by exploitability, and high-signal discovery across an entire codebase. Source

The research lineage matters. Google DeepMind introduced CodeMender in October 2025 as an agent that approaches code security both reactively, patching new vulnerabilities, and proactively, rewriting existing code to eliminate whole vulnerability classes. DeepMind reported that in its first six months, CodeMender upstreamed 72 security fixes to open source projects, including codebases as large as 4.5 million lines. The proactive showcase was applying -fbounds-safety annotations to parts of libwebp, the image compression library whose heap buffer overflow, CVE-2023-4863, was used in a zero-click iOS exploit; with the annotations, that vulnerability and most other buffer overflows in the annotated code would have been unexploitable. Source

What the November 4 update adds

The headline addition is secure autonomous remediation. CodeMender now isolates vulnerability verification and exploit simulation inside the customer's choice of an operating system-level sandbox or an isolated virtual machine, and adds human-in-the-loop checks for local write and command execution. Google's stated goal is reducing the risk of malicious exploits and zero-day testing gone wrong. Source

The second addition is flexible scanning modes: a specific folder, an entire repository, or only files modified since the last scan. That gives teams control over scan scope to balance speed and cost, and it is the kind of unglamorous feature that decides whether a security agent actually runs in CI every day. Source

Google also put numbers and names behind the preview. It says hundreds of customers have used CodeMender since July. Thales Group's CTO for cybersecurity services, Ivan Fontarensky, says early evaluation of CodeMender through Google's Fairwind Program shows potential to reduce vulnerability discovery time by over 95% while keeping validation and remediation under human oversight. IDC's Katie Norton frames the problem: nearly 40% of enterprises add vulnerabilities faster than they can remediate them. And Google disclosed that Wiz used Gemini 4 Argon, one of the models CodeMender works with, to identify and help remediate core PHP vulnerabilities that affected 70% of websites, with Argon contributing to finding the vulnerability, developing a likely exploit path, detecting attacks, and validating the patch. These are Google's own reported figures and customer quotes. Source

CodeMender did not arrive alone. The same summit announcements included Auth Manager for Agent Identity reaching general availability, centralizing agent credentials in a Google-managed vault with automated OAuth 2.0 and PKCE flows; Agent Identity JWT support in preview for cross-cloud authentication without static API keys; identity-based VPC Service Controls; and a Model Armor custom topic detector for keeping agent conversations on-topic. The pattern is a control plane for agents, and CodeMender is the piece that aims at the code those agents and humans ship. Source

How the agent works under the hood

DeepMind's technical post describes the machinery. The agent uses the thinking capabilities of Gemini Deep Think models, equipped with tools that let it reason about code before changing it: a debugger, a source code browser, and program analysis tooling spanning static analysis, dynamic analysis, differential testing, fuzzing, and SMT solvers. Those tools systematically scrutinize code patterns, control flow, and data flow to find root causes rather than symptoms. Source

The validation side is multi-agent. A special-purpose LLM-based critique tool highlights differences between original and modified code to verify that a proposed patch does not introduce regressions, and the agent self-corrects as needed. The bar for surfacing a patch to a human is that it fixes the root cause, is functionally correct, causes no regressions, and follows style guidelines. DeepMind's examples show why this matters: in one case a crash report pointed at a heap buffer overflow while the actual root cause was incorrect stack management of XML elements during parsing, and the final patch changed only a few lines. Source

The enterprise shape

The product page fills in the operational details. A lightweight CLI keeps scanning and fixing of proprietary code inside the customer's configured environment. CodeMender can ingest findings from cloud security tools like Wiz rather than only running its own scans. And its exploit validation is literal: it builds and runs an active proof-of-concept exploit in a customer-managed environment to prove exploitability, which is how it claims to eliminate false positives that CVE scores alone cannot resolve. Source

Wiz integration runs both ways in Google's telling. Wiz's AI SAST, now in preview, correlates code weaknesses with infrastructure context on the Wiz Security Graph, and exploitable attack paths can be remediated through Wiz's Green Agent and CodeMender. The two companies also launched Scan for Good, a joint initiative applying the technology for under-resourced organizations; Google says it helped more than 50 public service organizations and critical infrastructure providers find and remediate critical exposures in its first month. Source

Our read

This section is our assessment, not Google's claims. The design decision that stands out is the isolation boundary. An agent that writes and runs proof-of-concept exploits is, by construction, an agent that executes attack code; putting that work inside a sandbox or VM with human approval on local writes is the correct architecture, and it mirrors the approval-gate discipline we keep coming back to in least-privilege for AI agents. The difference between a security agent and a security incident is exactly this boundary, a point the workos breach post made from the other direction.

Second, exploitability validation is the feature to watch. Alert fatigue is the real AppSec bottleneck, and an agent that proves a vulnerability exploitable before asking a human to look is attacking the right problem. But it also concentrates risk: a wrong "not exploitable" verdict now silences a real finding. Teams adopting this should keep their independent signal on, at least until the false-negative rate is understood on their own codebases. The agentic attack surface categories in the OWASP agentic AI top 10 apply to the security tooling itself, not just the agents it guards.

Practical bottom line: CodeMender is still in preview, so treat it as an evaluation candidate for your 2027 AppSec stack, not a drop-in replacement for your existing scanners. The November isolation and scanning controls make it evaluable in a way the July preview was not.