CodeMender is a managed code security agent now in preview from Google. It aims to help security teams move from passive scanning to automated code remediation by combining AI scanning, exploit verification, and patch generation. The agent is built on Google DeepMind research and operates within the secure-by-design Agent Platform, with enterprise-grade guardrails including VPC traffic routing, data isolation, and zero retention of source code.

The core workflow has three phases: scan, verify, and remediate. During scanning, CodeMender examines code for hard-to-find vulnerabilities such as memory corruption, injection, and cryptographic flaws across languages including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. It uses model scanning with security context to uncover issues that static or model-only scans miss. In the verification phase, the agent builds and runs a proof-of-concept exploit in an isolated, customer-managed sandbox to confirm that a vulnerability is genuinely exploitable, cutting false positives. Finally, it generates a secure patch as a code diff and uses LLM-as-a-judge to test that the fix does not break existing functionality. Developers remain in control and must approve changes before they are committed.

CodeMender can be used with generally available Gemini models via the Gemini Enterprise Agent Platform, or deployed as a core component of AI Threat Defense, which is integrated with Wiz. In that setup, Wiz orchestrates application security analysis, calls CodeMender to scan code, enriches findings with deployment context, and triggers Wiz Red Agent for AI pentesting. The Wiz Green Agent then directs CodeMender to generate and test patches. This pipeline aims to let teams focus on the highest-risk vulnerabilities.

CodeMender supports a multi-model approach so users can choose the right model for cost, speed, and scanning depth. Third-party frontier model support is planned for later this year. A separate version with Gemini 3.5 Flash Cyber will be available to a limited set of governments and trusted partners, with broader access planned over time. CodeMender is described as a step toward a self-healing agentic software development lifecycle where code is autonomously secured before production.