Google Cloud is putting CodeMender, an AI agent designed to find and fix software vulnerabilities, into preview. The announcement places the system inside the company’s wider response to attacks that can move faster than conventional vulnerability-management queues. Its significance is less about another scanner than about connecting discovery, exploit validation and patch generation in one supervised workflow.
According to Google Cloud’s announcement, CodeMender can be used through Gemini Enterprise Agent Platform or deployed as a component of Google AI Threat Defense. The company describes it as a managed code-security agent, with a multi-model design intended to let teams balance cost, speed and deeper scanning performance. Google says third-party frontier-model options are planned later, but gives no timetable in the announcement.
From detection to an evidence-backed fix
CodeMender’s proposed workflow has three distinct stages. First, it scans repositories for vulnerability classes that include memory corruption, injection, web-security flaws, cryptographic weaknesses and insecure data handling. Google says the agent is designed to understand a repository’s context, goals and functionality rather than rely only on pattern matching. The announcement lists C and C++, Go, Java, Python, Ruby, Rust and TypeScript among the supported languages.
The second stage is verification. Instead of treating every static finding as equally urgent, CodeMender can build and run a proof-of-concept exploit inside an isolated, customer-managed sandbox. A successful simulation is meant to show that a flaw is exploitable in the tested environment, helping security teams reduce noise and prioritize issues with evidence behind them. That distinction matters: a generated exploit is a validation aid, not proof that every deployment will behave identically.
Once a vulnerability is verified, the agent generates a code fix and returns it as a diff within developer tools. Google says it can also test the proposed change and use an LLM-as-a-judge step to check that existing application functionality is not disrupted. These checks can support review, but they do not turn an AI-generated patch into an automatically trusted change.
Human approval remains the boundary
The most important control in the announcement is the handoff to developers. CodeMender does not commit patches to a repository or push them directly to production on its own, according to Google Cloud’s product documentation. Developers review and approve the diff before it enters version control. That keeps the agent’s role closer to an accelerated security analyst and patch author than to an unattended deployment system.
This boundary also clarifies where the operational work moves. Teams still need to check whether the reproduced exploit reflects production exposure, inspect the full patch rather than only the changed lines, run their own regression and security tests, and record the decision in the normal change-management process. A verified finding can improve prioritization; it cannot replace threat modeling, code ownership or release accountability.
Data handling is part of the security decision
Google Cloud says CodeMender can work through a lightweight local command-line client and customer-managed sandboxes. Its product page says source repositories do not need to be uploaded wholesale, while compilation, testing and exploit simulation can run in the customer’s environment. The same page describes encrypted active-session storage, a stated seven-day limit for resumption data, and a commitment not to use proprietary code, prompts or security findings to train Google’s foundation models.
Those assurances should be treated as deployment claims to verify against an organization’s own contract, configuration and data-residency requirements. Before a pilot, security teams should confirm which code snippets leave the local environment, how logs and prompts are retained, who can access generated exploit artifacts, and whether network controls such as VPC Service Controls fit the existing architecture. The fact that a tool is marketed as a secure agent does not remove the need for an architecture review.
A change in the remediation bottleneck
CodeMender’s preview arrives at a practical pressure point in application security. Finding more issues is useful only if teams can validate and fix the important ones before release. By combining code analysis with execution-based verification and a developer-approved patch, Google is proposing a way to compress that loop. The trade-off is that the workflow becomes more capable and more consequential: an agent that can run exploits and edit code needs tighter sandboxing, clearer permissions and stronger audit trails than a read-only assistant.
No independent performance test accompanies this announcement, so claims about missed vulnerabilities, reduced false positives or faster remediation should not be read as established benchmark results. The durable news is the workflow Google is making available in preview: AI-assisted discovery, customer-controlled verification and a reviewed code change. For teams considering it, the sensible starting point is a narrow, non-production pilot with representative repositories, explicit network boundaries and a human approval gate at every patch.