Google’s Gemini Enterprise Agent Platform has recently welcomed an innovative addition aimed at reinforcing cybersecurity within enterprises: CodeMender. This fully managed AI code security agent offers users the ability to find and rectify vulnerabilities present within their software code. Engineered by Google DeepMind, CodeMender made its debut in October 2025 as an advanced security research initiative, primarily focused on discovering software vulnerabilities independently and effectively.
In its early development, CodeMender showcased remarkable capabilities such as automated vulnerability detection, debugging, and patching solutions. The system employed cutting-edge Gemini reasoning models in combination with both static and dynamic code analysis tools. This synergy allowed CodeMender to conduct deep root-cause analyses to identify defects in codebases, moving beyond mere detection of theoretical security issues. It prioritized generating accurate patches and validating these against potential regressions, ensuring enhancements to code integrity.
During its initial research phase, the DeepMind team proudly reported that CodeMender not only detected issues but also proactively rewrote legacy code patterns. This foresight helped to eliminate entire classes of vulnerabilities, leading to the successful integration of 72 security fixes into major open-source projects, all under the supervision of human experts.
### Transitioning to an Enterprise-Ready Solution
With its transition from a research tool to an enterprise-capable AI code security agent, CodeMender’s capabilities have substantially expanded. Now integrated within Google Cloud infrastructure, it no longer relies solely on static code evaluations. The advanced agent actively constructs and runs proof-of-concept (PoC) exploits within customer-managed sandboxes, thereby verifying whether identified vulnerabilities are genuinely exploitable threats.
Additionally, CodeMender has streamlined the development process by delivering tested fixes straight to development pipelines, presenting these as code differences for review. It introduces a unique large language model-as-a-judge system, which ensures that proposed changes adhere to specified organizational rules and maintain the core business logic intact.
One of the standout features of CodeMender’s evolution is its multi-model capability, enabling developers to select from several models, including Gemini 3.5 Flash, Gemini 3.1 Pro, or Gemini 3 Flash. This selection allows for a customizable balance between cost and speed, as well as the depth of scanning required. Moreover, Google has indicated plans for supporting third-party frontier model options later in the year, signaling an intent to broaden the platform’s versatility further.
### Current Features and Roadmap Ahead
Enterprise customers seeking to enhance their cybersecurity posture can currently access CodeMender through the Google Cloud ecosystem. Presently available in public preview, this code security agent integrates seamlessly with the Gemini Enterprise Agent Platform, ensuring compatibility with local developer environments. It can be accessed via a command line interface (CLI) and is compatible with tools such as Visual Studio Code and the Antigravity desktop application.
In conjunction with the Google AI Threat Defense, CodeMender can be instantly implemented as a core component, collaborating with Mandiant’s frontline expertise and Wiz’s contextual risk prioritization. Security protocols such as secure traffic routing through a customer’s Virtual Private Cloud, data isolation, encryption, and the assurance of zero retention of source code data are fully operational as part of this offering.
Currently, CodeMender supports scanning and remediating vulnerabilities across several major programming languages, including C, C++, Go, Java, Python, Ruby, Rust, and JavaScript or TypeScript. The platform also supports popular enterprise frameworks, such as Django, Flask, React, Spring Boot, and Express. Notably, the default model employed is Gemini 3.5 Flash, while alternatives like Gemini 3.1 Pro and Gemini 3 Flash are also available for enterprise users.
Additionally, a specialized model, Gemini 3.5 Flash Cyber, has been developed specifically within CodeMender to swiftly identify, test, and patch critical flaws. Currently, this model is available only through a limited-access pilot program, with Google selectively allowing participation from governments and trusted partners due to its dual-use capabilities.
Upcoming features promise to enhance CodeMender’s functionality even further. Future integrations will enable Wiz to actively engage CodeMender in scanning code as part of the AI Threat Defense, orchestrating the remediation process. Google also intends to introduce advanced enterprise governance features, which will encompass features like robust user registration and identity management, sophisticated observability, audit logs, and localized data residency controls.
In sum, CodeMender represents a significant advancement in cybersecurity measures available to enterprises, combining the latest in AI technology with robust security protocols to safeguard vast arrays of software environments. Its continued development and integration within Google Cloud’s offerings solidify its role as a pivotal resource for organizations aiming to enhance their cybersecurity frameworks in an increasingly digital landscape.