Google Cloud is putting CodeMender, its AI agent for finding and fixing software vulnerabilities, into preview. The company presents the move as an attempt to close a familiar security gap: scanners can produce more findings than development teams can validate and remediate, while attackers are using automation to move faster. In its official announcement, Google Cloud describes CodeMender as a managed code-security agent that can scan repositories, test whether suspected flaws are exploitable, and generate a patch for developer approval.
Closing the gap between finding and fixing
CodeMender is built around three linked stages. It first scans code for vulnerability classes including memory corruption, injection, web-security problems, cryptographic flaws and unsafe data handling. Google says the agent understands the context and purpose of a repository rather than relying only on isolated code patterns, and supports common languages such as C/C++, Go, Java, Python, Ruby, Rust and TypeScript.
The second stage is verification. Instead of treating every scanner alert as equally actionable, CodeMender can build a proof-of-concept exploit and run it in an isolated, customer-managed sandbox. The objective is to establish whether a suspected weakness represents a real risk and to help teams prioritize confirmed issues. That distinction is important: an AI-generated exploit simulation can reduce noise, but it is still evidence produced inside a controlled test environment, not a replacement for a security team’s judgment.
The final stage is remediation. After a vulnerability has been verified, the agent generates a code diff and tests the proposed fix. Google says CodeMender uses an LLM-as-a-judge step to check that the patch does not disrupt existing application behavior, while developers retain responsibility for reviewing and approving the change before it is committed. The workflow therefore aims at automation without silently turning a model’s suggestion into production code.
Designed for controlled automation
The preview combines a hosted agent with a local client that can operate as a command-line interface and a daemon for running commands on the user’s machine. Google Cloud says CodeMender can connect to repositories and developer tools, fit into CI/CD workflows, or run in a locally managed sandbox. Its security controls include traffic routing through a customer VPC, data isolation and encryption, and a design that limits what the hosted service receives.
The current CodeMender documentation adds an important operational detail: the CLI does not upload an entire source repository to Google’s servers. It sends targeted file contents or snippets, vulnerability information, proposed patches, command results and related metadata. The documentation says session data can be retained for up to seven days to support resuming work, with an option for customers to request earlier deletion. That is a more useful privacy description than a broad promise that code simply “stays local”; teams still need to understand which artifacts leave their environment.
The same documentation labels CodeMender as a pre-GA offering and warns customers to supervise its use, avoid situations where serious errors cannot be corrected, and keep human confirmation in place for write and tool-execution actions. It also warns that the agent can execute commands and modify files. For a security team, those caveats are not footnotes: sandbox boundaries, network access, repository permissions and approval gates are part of the deployment decision.
Preview status sets the expectations
CodeMender is available in public preview to a limited set of customers through Gemini Enterprise Agent Platform, according to Google Cloud’s documentation. The announcement also describes a path to use it as a component of Google’s broader AI Threat Defense offering. Google says customers can use its generally available Gemini models through Agent Platform, while support for third-party frontier models is planned for later in the year. No pricing or general-availability date is given in the announcement.
That status matters because the announcement is a product release, not an independent performance study. Google cites early customer feedback and describes CodeMender’s intended workflow, but it does not publish a neutral benchmark in the announcement that would establish a universal detection rate, patch success rate or reduction in false positives. Security leaders should read “verified” as a description of the agent’s proposed process, not as a guarantee that every finding or patch will be correct.
Why the announcement matters
AI-assisted application security is moving from alert generation toward an end-to-end loop: discover a weakness, test its exploitability, propose a repair and return the change to a human-controlled development process. CodeMender’s significance is less about replacing static analysis than about connecting several steps that are usually separated across scanners, exploit triage, issue trackers and developer tools.
For organizations evaluating the preview, the defensible starting point is narrow scope: use a non-production repository, isolate exploit execution, restrict credentials, preserve human approval and review the generated diff with the same care applied to a manual patch. Keep logs of prompts, commands, findings and approvals, and measure the agent against known issues in the organization’s own code rather than relying on vendor language alone.
Google Cloud’s CodeMender preview is therefore a meaningful announcement, but not a finished answer to AI-era application security. It shows how vendors are trying to compress the distance between vulnerability discovery and remediation. Whether that speed improves security will depend on the quality of the evidence, the safety of the execution environment and the governance wrapped around the agent.