Google launches CodeMender to scan & fix vulnerabilities

Google has introduced CodeMender in preview, a managed code security agent that scans for and fixes software vulnerabilities.

The launch adds code remediation to Google's security and developer tooling. The product is available through the Gemini Enterprise Agent Platform and as part of AI Threat Defence.

CodeMender is designed to inspect software repositories, identify security flaws, test whether they can be exploited, and generate code fixes for developer review. It can work within existing continuous integration and continuous delivery workflows or in local developer environments through a command-line interface client.

The agent can connect to code repositories and developer tools including VS Code and Antigravity. It supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript, and is intended for first-party, open-source, and third-party software.

How it works

The product is structured around three stages: scanning, verification, and remediation. In the first stage, it searches for vulnerability classes including memory corruption, injection flaws, web security issues, cryptographic weaknesses, and insecure data handling.

The verification step is intended to reduce false positives by building and running proof-of-concept exploits in an isolated sandbox managed by the customer. If a flaw is shown to be exploitable, the tool can create a patch and deliver it as a code diff for developer review and approval.

Developers remain responsible for deciding whether any change is committed to the repository. The system also tests generated fixes to check that they do not disrupt existing application behaviour.

Google is positioning the product as part of a wider shift in software security, with defenders using AI systems to match the speed of AI-assisted attacks. That framing reflects a broader industry debate over how security teams can keep up with fast-moving threats without adding large amounts of manual review work.

Users can choose from more than one model depending on cost, speed, and the depth of scanning required. Support for third-party frontier models is due later.

Customer feedback

Several companies provided early comments on the product's use in software security workflows.

"At Salesforce, trust is our number one value, and protecting customer data means continually raising the bar for how we find, validate, and mitigate risks. CodeMender brings AI into a critical part of the security lifecycle by accelerating the path from validated vulnerability to tested fix. As AI reshapes the threat landscape, capabilities like this help strengthen resilience and give our customers the confidence to keep innovating," said Iain Mulholland, CISO, Salesforce.

"CodeMender consistently identified critical vulnerabilities that our other AI-enabled tools completely missed. It doesn't just find theoretical flaws - it proves the immediate risk and delivers targeted, validated fixes that secure our environment without disrupting core business logic," said Scott Ponte, Head of Security Operations, Robinhood.

"CodeMender is fast, comprehensive, and genuinely ambitious about closing the loop from detection to fix, enabling teams to secure their software supply chain without losing velocity," said Ashwin Kannan, Principal AI Engineer, Office of the CTO, Palo Alto Networks.

Broader security push

Google is also tying CodeMender to AI Threat Defence, where Wiz acts as the control layer for investigation and remediation workflows. In that setup, Wiz can call CodeMender to scan code, add findings to the Wiz Security Graph with deployment context, and trigger AI-based pentesting to assess exploitability.

That arrangement places the product within a broader market for automated application security, where cloud vendors and specialist security groups are trying to combine code analysis, attack simulation, and patch generation in a single workflow. The approach aims to narrow the gap between identifying a flaw and fixing it, a stage that often slows security operations in large software estates.

CodeMender runs within Google's Agent Platform with measures including secure traffic routing through a customer's virtual private cloud, data isolation, encryption, and zero retention of source code data. Customers can also configure the tool to scan and analyse code in a sandbox they manage.

The launch extends Google's efforts to embed AI agents more deeply into enterprise software operations, particularly in areas where security teams face large backlogs and limited staff. Rather than replacing developers, the model keeps human review in place while shifting more of the scanning, exploit testing, and patch drafting to automated systems.

CodeMender with Gemini 3.5 Flash Cyber will be exclusively available to a small set of governments and trusted partners.