Google launches CodeMender, an AI agent that finds vulnerabilities automatically

Google has expanded access to CodeMender, an AI agent that automatically finds and fixes vulnerabilities in code. The company announced the move at the Google I/O conference, strengthening its position in AI security.

What is CodeMender

CodeMender is an AI agent built on the Gemini model and designed specifically to protect source code. The tool scans code for potential vulnerabilities and does more than flag them: it proposes ready-made patches with explanations. This sharply reduces the load on security teams and lets developers fix security problems while they write code, before it reaches production.

CodeMender understands project context: it sees dependencies, function call chains and the libraries in use. That makes its recommendations more accurate than those of simple static analyzers.

How it works

The agent integrates with the IDEs developers already use, and with CI/CD systems, through plugins and APIs. When a developer uploads, changes or reviews code, CodeMender scans it:

• Detects classic vulnerabilities: SQL injection, XSS, buffer overflow, insecure deserialization
• Analyzes program logic and call chains for unsafe behavior
• Proposes concrete patches, explaining the risk and how to fix it
• Integrates with GitHub, GitLab, Gitea and other version control platforms
• Works at the level of a single file or an entire project
• Learns from vulnerability patterns and improves over time

Previously, such checks required either a manual audit (expensive and slow) or costly security tooling (hard to integrate). CodeMender makes a first level of protection available to every developer.

A response to competitors

Google is entering an intense race with OpenAI and Anthropic. OpenAI is developing Operator and other agents for working with code and the browser. Anthropic is working on its own developer tools. All three companies share one view: cybersecurity is not just a feature of AI tools but a separate line of business for the future.

Google is leaning on its strengths: the massive Google Cloud infrastructure and its presence in the Android, Chrome, Gmail and other ecosystems where security is critical. If CodeMender becomes an industry standard, Google will gain a huge volume of data on vulnerability types in real-world code and will be able to improve Gemini even further.

What it means

Security is shifting from reactive (catching a bug in production) to proactive (preventing it during development). For developers, that means fewer sleepless nights over incidents. For companies, lower spending on security staff and audits. For Google, a firmer hold on the cloud ecosystem and one more lever of influence over millions of developers.