The service is available through the Gemini Enterprise Agent Platform and can also operate as a component of Google AI Threat Defense. It marks the transition of CodeMender from a Google DeepMind research project into an enterprise product that can be integrated with development tools and software delivery pipelines.
CodeMender differs from conventional code scanners by attempting to establish whether a detected weakness can actually be exploited. The agent creates proof-of-concept exploit code and runs it inside an isolated sandbox managed by the customer. This allows security teams to distinguish practical threats from theoretical findings and direct resources towards flaws presenting the greatest risk.
After confirming exploitability, the agent produces a patch, tests the change and supplies it to developers as a code difference for review. CodeMender does not automatically commit changes to repositories or push them into production. A developer must examine and approve each proposed fix, maintaining a human checkpoint within the remediation process.
Google said the agent can scan for memory corruption, injection vulnerabilities, web security defects, cryptographic weaknesses and unsafe data handling. It supports C and C++, Go, Java, Python, Ruby, Rust and TypeScript, covering languages widely used in enterprise applications, cloud services and open-source infrastructure.
The underlying system combines artificial intelligence models with security tools such as static analysis, dynamic analysis, fuzzing, differential testing and mathematical solvers. Rather than relying only on patterns associated with known bugs, the agent analyses control flow, data flow, application behaviour and the wider context of a software repository.
Code compilation, testing and exploit execution take place inside customer-controlled local sandboxes or isolated virtual machines. The agent’s reasoning and orchestration functions are hosted through Google’s platform. Organisations can route traffic through their virtual private cloud, while Google says source-code data is isolated, encrypted and subject to a zero-retention policy.
Developers can operate CodeMender through a lightweight command-line interface or integrations with tools including Visual Studio Code. It can also run as a headless agent inside continuous integration and continuous delivery pipelines, allowing security checks and patch generation to become part of routine software development.
The launch comes as security teams struggle with large volumes of scanner alerts, many of which require manual investigation before their significance can be established. False positives can delay remediation by forcing engineers to examine warnings that do not represent a workable attack path. Exploit-based verification is intended to reduce that burden, although running automatically generated attack code introduces operational risks that make strong isolation essential.
Security research has shown that coding agents and their sandboxes can face prompt-injection attacks, supply-chain manipulation and attempts to cross execution boundaries. Malicious instructions concealed in repositories, documentation or dependencies may influence an agent’s actions. Customer-managed environments therefore give organisations more control, but they also place responsibility on administrators to configure, patch and monitor those environments securely.
CodeMender began as a DeepMind project announced in October 2025. During its first six months of development, it contributed 72 security fixes to open-source projects, including codebases containing as many as 4.5 million lines. Its early work included tracing complex memory errors and applying broader safeguards intended to prevent entire categories of buffer-related vulnerabilities.
The agent has been tested by companies including Salesforce, Robinhood and Palo Alto Networks. Google is also positioning it alongside Wiz, the cloud security company it agreed to acquire, and Mandiant, its incident response and threat intelligence operation. Planned integrations would use deployment context from the Wiz Security Graph to identify exposed applications and instruct CodeMender to generate targeted repairs.
Customers can select from multiple models depending on the required balance of speed, cost and scanning depth. Support for third-party frontier models is planned later this year, potentially making CodeMender less dependent on a single model family.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
