Google CodeMender

CodeMender is Google's AI security agent, launched in preview in 2026, designed to move vulnerability remediation from passive scanning to autonomous fix generation. It scans codebases for memory corruption, injection flaws, web security issues, cryptographic problems, and insecure data handling across C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. Unlike static analysis tools that flag patterns and leave triage to humans, CodeMender builds a proof-of-concept exploit and runs it in an isolated customer-managed sandbox — only confirmed-exploitable vulnerabilities move forward. It then generates a secure patch delivered as a code diff in VS Code or Google's Antigravity IDE, with an LLM-as-a-judge step verifying the fix doesn't break application logic. Google reported 55 confirmed vulnerabilities found in its own V8 engine during internal testing.

The honest picture: CodeMender is in preview and currently runs via the Gemini Enterprise Agent Platform or Google's AI Threat Defense product — it's an enterprise offering, not a tool individual developers can just install. The most capable model tier (Gemini 3.5 Flash Cyber) is limited to governments and trusted partners. Developers must still manually review and approve every patch, so it compresses triage rather than eliminating human judgment.

Available in preview through the Gemini Enterprise Agent Platform or as part of Google AI Threat Defense. Contact Google Cloud sales for preview access.