Back cloud.google.com

CodeMender

cloud.google.com • September 2, 2026

The CodeMender agent provides a fine-tuned security harness to find and fix code vulnerabilities. It is managed and hosted as a code security agent on Gemini Enterprise Agent Platform with built-in governance and developer tool integrations.

Accelerate secure development with flexibility and control

Multi-model flexibility Optimize for cost, speed, or deep coding performance

Multi-model flexibility

Optimize for cost, speed, or deep coding performance

Automated remediation Eliminate manual verification and patching

Automated remediation

Eliminate manual verification and patching

Prioritized by exploitability Simulate exploits to prioritize fixes

Prioritized by exploitability

Simulate exploits to prioritize fixes

See the CodeMender agent in action

Watch CodeMender scan for vulnerabilities, validate exploitable risk, and generate verified code fixes to help secure applications.

Streamline scanning workflows

Seamlessly ingest findings from cloud security tools like Wiz while leveraging flexible multi-model support to optimize for cost, speed, or performance.

Keep source code in your environment

Work safely with a secure, lightweight CLI that ensures scanning and fixing your proprietary code is entirely within your configured environment.

Scan your entire codebase

High-signal vulnerability discovery across your entire codebase.

Uncover deep vulnerabilities

Hunt for complex flaws using multiple models—from memory corruption to injection attacks—across multi-language codebases using advanced, agent-based analysis.

Streamline scanning workflows

Seamlessly ingest findings from cloud security tools like Wiz while leveraging flexible multi-model support to optimize for cost, speed, or performance.

Keep source code in your environment

Work safely with a secure, lightweight CLI that ensures scanning and fixing your proprietary code is entirely within your configured environment.

Scan your entire codebase

High-signal vulnerability discovery across your entire codebase.

Streamline scanning workflows

Seamlessly ingest findings from cloud security tools like Wiz while leveraging flexible multi-model support to optimize for cost, speed, or performance.

Keep source code in your environment

Work safely with a secure, lightweight CLI that ensures scanning and fixing your proprietary code is entirely within your configured environment.

Uncover deep vulnerabilities

Hunt for complex flaws using multiple models—from memory corruption to injection attacks—across multi-language codebases using advanced, agent-based analysis.

Streamline scanning workflows

Seamlessly ingest findings from cloud security tools like Wiz while leveraging flexible multi-model support to optimize for cost, speed, or performance.

Keep source code in your environment

Work safely with a secure, lightweight CLI that ensures scanning and fixing your proprietary code is entirely within your configured environment.

Real-world exploit-based validation to eliminate false positives.

Validate using real-world exploits

Move beyond CVE scores. CodeMender builds and runs an active, proof-of-concept exploit in a customer-managed environment to definitively prove exploitability.

Prioritize actionable vulnerabilities

Ensure developers only spend time on high-confidence, actionable vulnerabilities, dramatically reducing alert fatigue.

Uses a specialized security harness and DeepMind techniques to trace complex control flows and data paths.

Prioritize actionable vulnerabilities

Ensure developers only spend time on high-confidence, actionable vulnerabilities, dramatically reducing alert fatigue.

Uses a specialized security harness and DeepMind techniques to trace complex control flows and data paths.

Real-world exploit-based validation to eliminate false positives.

Prioritize actionable vulnerabilities

Ensure developers only spend time on high-confidence, actionable vulnerabilities, dramatically reducing alert fatigue.

Uses a specialized security harness and DeepMind techniques to trace complex control flows and data paths.

Validate using real-world exploits

Move beyond CVE scores. CodeMender builds and runs an active, proof-of-concept exploit in a customer-managed environment to definitively prove exploitability.

Prioritize actionable vulnerabilities

Ensure developers only spend time on high-confidence, actionable vulnerabilities, dramatically reducing alert fatigue.

Uses a specialized security harness and DeepMind techniques to trace complex control flows and data paths.

Deploy production-grade patches

Automatically validate proposed fixes using LLM judges to ensure existing functionality remains intact.

Maintain developer control

Developers review, approve, and apply CodeMender's patches directly within their existing IDEs and CLI tools.

Remediate with automatically generated patches

Intelligent, self-validating patch generation and deployment.

Generate automated fixes

Generate code diffs and pull requests that not only patch the exploit but address the underlying root cause of the vulnerability.

Deploy production-grade patches

Automatically validate proposed fixes using LLM judges to ensure existing functionality remains intact.

Maintain developer control

Developers review, approve, and apply CodeMender's patches directly within their existing IDEs and CLI tools.

Remediate with automatically generated patches

Intelligent, self-validating patch generation and deployment.

Deploy production-grade patches

Automatically validate proposed fixes using LLM judges to ensure existing functionality remains intact.

Maintain developer control

Developers review, approve, and apply CodeMender's patches directly within their existing IDEs and CLI tools.

Generate automated fixes

Generate code diffs and pull requests that not only patch the exploit but address the underlying root cause of the vulnerability.

Deploy production-grade patches

Automatically validate proposed fixes using LLM judges to ensure existing functionality remains intact.

Maintain developer control

Developers review, approve, and apply CodeMender's patches directly within their existing IDEs and CLI tools.

CodeMender is a core component of AI Threat Defense

An always-on autonomous security platform designed to outpace AI-driven attacks. AI Threat Defense fuses the reasoning power of Gemini, the contextual risk prioritization of Wiz, the code remediation capabilities of CodeMender, and the frontline expertise of Mandiant.

The solution is based on a proven four-step framework taken from Google’s own approach to combating today’s threats.

Event Security Talks 2026: AI Threat Defense

Security Talks 2026: AI Threat Defense

Report AI Threat Tracker from Google Threat Intelligence Group

AI Threat Tracker from Google Threat Intelligence Group

Demo See Wiz in action. Security at AI speed, powered by context.

See Wiz in action. Security at AI speed, powered by context.

Gemini 3.5 Flash Cyber: A highly capable lightweight model for software security Read the blog

Evaluating threats and automating defense: How Google is advancing code security Video (20:28) Watch the video

Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber Read the blog

Secure what's : AI-driven defense for the enterprise Video (50:51) Watch the video

Defending your enterprise when AI models can find vulnerabilities faster than ever Webinar: 49:00 Watch the webinar

The 2026 AI threat landscape Video (37:03) Watch the video

Google CodeMender frequently asked questions

What is Google CodeMender?

Google CodeMender on Gemini Enterprise Agent Platform is an autonomous, AI-powered security agent originally developed by Google DeepMind to find, verify, and remediate deep vulnerabilities in your codebase. Tested across Google's own production environments, it uses a fine-tuned security harness that is built and continuously updated by Google DeepMind, and a selection of models to analyze root causes, run exploit simulations to confirm vulnerabilities are real, and generate precise code fixes.

How does CodeMender fit into the broader Google AI Threat Defense?

Google AI Threat Defense is an always-on, autonomous security platform designed to outpace AI-driven attacks. It seamlessly integrates the reasoning power of frontier models like Gemini, the contextual cloud-risk prioritization of Wiz, the autonomous code remediation capabilities of CodeMender, and the frontline incident response expertise of Mandiant. Within AI Threat Defense, CodeMender serves as the primary code security agent, bridging real-world cloud exposures directly with automated, developer-approved codebase patching.

How is CodeMender different from static scanners and standalone AI models?

CodeMender shifts security from passive scanning to active remediation. Unlike traditional static scanners that flood teams with false positives, or standalone models lacking execution logic and context, CodeMender pairs advanced AI models with a fine-tuned harness and comprehensive security toolbox to deliver better performance in vulnerability fixing than models alone. CodeMender enables you to:

Deploy the best-fit model . You can choose from multiple models to optimize for costs, speed, deep scanning, and coding performance.

Accelerate machine-scale remediation . You can now eliminate remediation bottlenecks caused by manual verification and patching, while keeping developers in the loop.

Prioritize fixes by exploitability . You can run proof-of-concept exploits and execute simulations to verify vulnerabilities in the code are exploitable, and prioritize tokens on fixing critical ones first.

How does CodeMender identify vulnerabilities during the "Scan" phase?

Traditional static scanners rely on simple pattern matching, which generates high volumes of noisy alerts and false positives. CodeMender acts differently, performing high-signal, deep scans across complex, multi-language codebases. It leverages advanced program analysis to trace control flows and data paths, allowing it to understand the unique context, goals, and functionality of your application to discover sophisticated vulnerabilities that static and model-only scanning miss.

What is the execution-based "Verify" and how does it eliminate alert fatigue?

The most critical bottleneck in application security is the time spent triaging false positives. CodeMender solves this through execution-based verification . Rather than statically analyzing code patterns, the agent builds your code and executes a secure proof-of-concept exploit . If the exploit succeeds, the vulnerability is verified to be exploitable, allowing your security practitioners and developers to focus their energy and token costs on legitimate risks.

How does the "Remediate" phase generate and validate production-ready patches?

Once a security flaw is verified, CodeMender automatically generates a patch, delivered as a standard code diff directly within developer tools. To ensure the fix is production-ready, CodeMender uses an LLM-as-a-judge framework to validate the patch. The agent automatically tests the modified code to ensure program equivalence, meaning the patch resolves the root cause of the vulnerability without altering the application's intended behavior or breaking existing features. The patch is presented to the developer as a code diff for them to review and approve before committing the patch to their code base.

What models are supported?

For the latest list of supported models, you can check our documentation . CodeMender with Gemini 3.5 Flash Cyber will be exclusively available to a small set of governments and trusted partners. We plan to expand this access over time.

What programming languages and frameworks are supported?

CodeMender is built for enterprise-scale complexity, providing comprehensive coverage across major language ecosystems shown below. For the latest, you can check our documentation .

Languages: C/C++, Java, Python, TypeScript/JavaScript, Go, Rust, and Ruby

Frameworks: Broad support for standard libraries within these languages, as well as common enterprise frameworks (e.g., HTML/CSS, Django, Flask, React, Spring Boot, and Express)

How is CodeMender deployed, and how do developers interact with it?

CodeMender is hosted as a secure headless agent on the Gemini Enterprise Agent Platform . Developers interact with it using CodeMender’s local Command Line Interface (CLI) and tools such as VS Code to run scans, review findings, trigger exploit verification, generate patches, and manage sessions. Core reasoning and orchestration occur in the cloud, while code compilation, test execution, and exploit simulations run in customer-managed local sandboxes or isolated VMs.

Can CodeMender be integrated within CI/CD pipelines?

Yes. In addition to interactive developer workflows, CodeMender can operate as a headless agent. For automated pipelines, the CodeMender binary can be packaged inside a custom container.

How does CodeMender integrate with Wiz?

Under the Google AI Threat Defense system CodeMender works with Wiz :

Context-Rich Scanning and Prioritization: Wiz orchestrates agentic application security, analyzing applications to prioritize investigations. It calls CodeMender to scan code (coming soon), enriches findings within the Wiz Security Graph with deployment context, and triggers Wiz Red Agent for AI pentesting to prove exploitability, ensuring teams focus on the highest-risk vulnerabilities.

Targeted Remediation: Wiz serves as a command center for governing and scaling remediation. The Wiz Green Agent orchestrates this lifecycle by directing CodeMender to generate and test high-fidelity patches enriched with application context from the Security Graph. This workflow empowers teams to resolve complex vulnerabilities with unprecedented speed and precision.

Do developers retain control over code changes?

Absolutely. CodeMender enforces a strict human-in-the-loop governance model. The agent does not automatically apply patches to your version control system or push code directly to production repositories. All suggested patches are provided as local code diffs, and changes are only committed to the repository after a developer has manually reviewed and approved them.

Where does my source code go? Is it secure?

Your proprietary source code remains entirely private and secure. CodeMender is architected from the ground up with strict data privacy perimeters:

No Repository Uploads: You never need to upload your source repositories to Google Cloud. The CodeMender agent only requests and processes the minimum necessary code snippets via secure communication with the CLI client on your local machine.

Sandbox Compilation and Verification: To ensure logic remains on the client side, all code builds, test executions, and exploit simulations are run entirely on customer-managed infrastructure or sandboxes — never on Google-managed infrastructure.

Minimal Data Retention : Google does not retain any source code, prompts, scan outputs, or patches on Google-side storage beyond active session data, which is stored encrypted for up to seven days from session creation to enable resumption of long-running find and fix scans. Scan outputs, exploits, and patch code are sent back to the client and stored locally on your machine.

No Model Training: Your proprietary code, prompts, and security findings are never used to train Google's foundation models.

What platform-level security and compliance controls are provided?

Hosted securely on the Gemini Enterprise Agent Platform , CodeMender provides the following enterprise guardrails:

VPC Service Controls (VPC-SC): Establishes strict network perimeters around agent communication, providing enhanced protection against data exfiltration.

Secure Traffic Routing: Gives customers the option to route all CLI and agent communications exclusively through their VPC on Google's private, encrypted backbone network, mitigating eavesdropping risks.

Start your security transformation today

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Launches Fairwind Program with Advanced Cyber AI Models On September 2, 2026, Google announced the launch of its Fairwind Program, providing trusted partners with early access to advanced AI models for cybersecurity, including Gemini 3.8 Flash Cyber and CodeMender. This initiative aims to help governments and critical infrastructure operators proactively defend against cyber threats. The program focuses on autonomous vulnerability discovery and remediation, allowing organizations to generate verified code fixes rapidly. Over 650 partners, including government agencies and cybersecurity firms, are participating in this initiative. The Gemini 3.8 model is designed to improve defenses before new threats emerge, enhancing the security of essential services. The program emphasizes strict governance standards to ensure responsible use of these powerful AI capabilities. The collaboration includes notable partners like CrowdStrike and Palo Alto Networks, aiming to bolster defenses across various sectors. 6 sources 35

Extracted Entities

Platforms (1)

Gemini Enterprise Agent Platform