What is CodeMender? Google's Code Safety Agent Guide

TagsGoogle DeepMind is an artificial intelligence agent that confirms whether these opens are really abused and produces tested patches. Published as research project on 06.10.2025; since 22.07.2026, Google Cloud has been presented as a limited number of corporate customers preview. A person before entering the code of the patches it produces is passing through the approval of the developer today.

Last update: 14.10.2026

The security in the software world is seen as a "fix" battle that does not come for many years. Although developers and automated tools try to find errors by scanning thousands of lines code every day, they multiply the points that traditional automated methods such as human eye and fuzzing are insufficient. Google DeepMind in response to this problem CodeMender Project Home announced.

CodeMender is not only a bug finder; it is an autonomous artificial intelligence agent, which can rewrite the open ones found from the root cause and the existing code with safer structures. The research version was working with Gemini Deep Think models. The version on Google Cloud allows Google to choose according to the cost, speed and dredging depth from Gemini models open to general use. Below you can find out how CodeMender works and what stage it is today.

What is CodeMender and How to Change the Software World?

• What? CodeMender is an artificial intelligence agent developed by Google DeepMind, detecting, analyzing and producing high quality patches (patches) that automatically detect complex software open.

• How it Works? The system mimics the workflow of a senior engineer. Not only detect error; debugger and source code scanner finds the "root cause" of the error using tools such as. After creating the patch, it passes through a multi-stage testing process to verify functional equivalent.

What is the Architectural Power of CodeMender for Software Safety?

The outstanding feature of CodeMender does not only make a superficial "yama". Most vehicles focus on the specification in the crash report; CodeMender targets architectural weaknesses with deep thinking capacity of Gemini Deep Think models.

Technical Mobility:

• Advanced Program Analysis: Static and dynamic analysis examines the control flow of code with differential tests, fuzzing and SMT solvents (control flow).

• Multiple Agent Systems (Multi-agent Systems): It uses special agents that address different aspects of the problem. For example, when writing an agent, they check whether or not new errors (regressions) are formed and formed by comparing one other (critical tool) to the original code.

• Autonom Error Extraction: By synthesize Debugger outputs and code search tools, it can detect the actual cause of crash (e.g. faulty XML stack management).

What is the Proactive Approach in the Software Apparatus Repair Process?

One of the most exciting aspects of CodeMender is "reactive" and "proactive". So, they update the code with safer structures without waiting to be an attack.

DeepMind researchers used CodeMender to strengthen the widely used libwebp image compression library. The vehicle automatically placed the code -fbounds-safety attachments. These additional descriptions allow compiler (compiler) to add limit controls to the code. According to DeepMind, most of the buffer overflow open in the library become unremovable. CVE-2023-4863 deficit used in the attack of zero-click (zero-click) for iOS devices in 2023 was a heap buffer overflow error in libwebp.

Can Be Trusted With Artificial Intelligence Coding?

The biggest risk of the code produced by artificial intelligence is the potential to disrupt another place while correcting. CodeMender exceeds this trust issue with a strict verification process:

It is necessary to meet the following criteria before the patch is submitted to human review:

1. Root Why Solution: Not only the symptom, the actual problem should be solved.

2. Functional Accuracy: Not to disrupt existing functions.

3. Style Compliance: The project should remain loyal to the typing rules (coding style).

4. Self Correction: If a test fails, the agent will automatically analyze the error and revise the solution.

Open Source Security and Future Vision

Google DeepMindThe CodeMender follows a cautious and trust-oriented way to expand. Every patch produced during the research period was controlled by human researchers before sent to open source projects. The patches are presented in the Google Cloud version as code difference (diff) and passes through the review and approval of the developer before entering the warehouse.

In the future, software security is aimed to become a standard and automated process, just like running a compiler. CodeMender is determined to change the perception of "software is necessarily broken from one place" which is accepted for years. As this technology evolves, we will step into a world where the software is safe with inspection, not with the construction process.

The success of CodeMender and similar systems will make our global digital infrastructure more resistant. For software engineering, this means getting rid of strenuous patch works and return to creativity.

DeepMind said that in the announcement in 2025, the results will be shared with technical articles and reports, and the patches will gradually present to the maintenanceers of critical open source projects. In 2026, CodeMender company was opened to use; this kind of agents of security teams make it easier to plan their existing CI/CD processes.

CodeMender in 2026: Google Cloud preview

Google Cloud opened its customers as a preview of CodeMender in 22.07.2026. The agent can be used on Gemini Enterprise Agent Platform or as part of the AI Threat Defense. According to documents, preview is currently required to discuss the sales team for a limited number of customers open and access.

This version works in three steps:

• Find: Scans the code base or imports findings of other security tools.

• Verify: The code joints and evidence of the concept in an isolated environment of your governance (proof-of-concept) indicates whether there is a real risk of the vulnerability, so incorrect alarms are eliminated.

• Tags: Produce and test the patch, with a great language model-based evaluator (LLM-as-a-judge) controls the existing functions intact, and the change provides the approval of the developer.

By default, C/C++ supports C#/.NET, Go, Java, JavaScript, TypeScript, Kotlin, Python, Ruby, Rust and PHP languages. The agent is used by connecting a light command line client or CI/CD line running on the computer; VS Code and Antigravity works with developer tools. Google announced that it will also add third party model options in 2026.

Comparison of Google Cloud version with research version

Limited number of corporate customers (through sales team)

Home

Gemini Deep Think

Select from Gemini models for general use

Who confirms the patch?

Human researchers (before sending open source projects)

Developer (before inserting into account)

Featured results

72 security corrections to open source projects

It explains and tested patches verified by the exception

Frequently Asked Questions

Is CodeMender free?

No, it is not a free tool for everyone to download and use. CodeMender is offered as preview for corporate customers in Google Cloud and you need to discuss Google sales team for access. Google does not contain price information on 22.07.2026 announcement.

Can I use CodeMender as an individual developer?

It is not available directly to individual use; preview for Google Cloud customers. For code review on your own project artificial intelligence code writing tools You can browse.

What programming languages do CodeMender support?

By default C/C++, C#/.NET, Go, Java, JavaScript, TypeScript, Kotlin, Python, Ruby, Rust and PHP. You can also scan other languages by adding file extension to the set file according to the documents.

Is CodeMender patches add to the code itself?

No. Patches are offered to the developer as code difference (diff); no change is added to the warehouse without reviewing the developer and approval.

What is the difference between CodeMender and fuzzing?

Fuzzing is a test method for crashing by giving random or semi- random entries to the program. CodeMender is using fuzzing as one of the tools, it examines the root cause of the vulnerability it finds and tests it to produce and close it.