Google Cloud launches AI cybersecurity agent CodeMender

Google Cloud launched CodeMender, a security AI agent that's part of Gemini Enterprise that finds vulnerabilities and patches them.

CodeMender, a headless multi-model AI agent, is in public preview and available to Gemini Enterprise Agent Platform customers. Once CodeMender emerges from preview it will have a consumption-based model based on token usage, but include model choices to optimize for costs.

The launch of CodeMender, which is integrated into Google Cloud's Wiz platform, lands as machine-speed cybersecurity is becoming a critical issue. The launch of Anthropic's Mythos model has spurred cybersecurity demand and retooled security ops strategies.

• Fable 5 and the Shift From Model Capability to Capability Governance
• Claude Mythos and the New Cybersecurity Operating Model

Speaking on a call with analysts, Clemens Viernickel, director and product manager for Google Cloud AI, said CodeMinder, available in a command line interface, is designed to speed up the time it takes to patch vulnerabilities.

The multi-model AI code security agent does the following:

• Initiates LLM-based scans for deep code vulnerabilities.
• Verifies vulnerabilities by building and running proof-of-concept exploits in a sandbox environment.
• Remediates and generates patches for verified vulnerabilities and security issues with developer approval.

"We think about vulnerability management in these four steps. First is preparation, second is scanning, third is remediation and fourth is actually the monitoring part," said Viernickel. "We see a big opportunity to provide better tools and services to our customers in this scan and especially in the remediation steps."

Viernickel said there's a gap between the time it takes to discover a vulnerability and patch them. Discovery time is now minutes to days and patch development, testing and approval can take anywhere from 20 days to 70 days.

• Google Cloud Next 2026: A Look at the Big Themes
• Google Cloud presses full-stack AI edge with new TPUs, Agentic Data Cloud, Gemini Enterprise Agent Platform
• Google Cloud with Wiz eye multi-cloud, multi-model security
• Constellation ShortList™ Cloud Native Application Protection Platforms (CNAPP)

Here's a look at the key points about CodeMender:

CodeMender has a security-tuned harness with tools, skills and prompts and a choice of models such as Gemini 3.5 Flash, Gemini 3.1 Pro and third-party models hosted by Google Cloud in the future. "We strongly believe that the agent is better than the model by itself," said Viernickel. "It's pretty obvious that different models are strongest at different types of categories of vulnerabilities."

Google Cloud said CodeMender has security and controls for agent safety and security, virtual private clouds and no retention of source code data available now with registration and identity, observability and audit, and data residency coming in the future.

CodeMender can be deployed as a service in Google Cloud's Gemini Enterprise Agent Platform or in a customer managed environment on-premises or in other clouds.

Wiz integration. Wiz uses context-driven targeting via its Security Graph to prioritize CodeMender scans on high-risk repositories. CodeMender uploads discovered and validated vulnerabilities to Wiz and uses its Red Agent to pen test them. Wiz then calls CodeMender via its Green Agent to fix vulnerabilities and then provides additional deployment context to CodeMender.

"CodeMender and Wiz is like a great first example of how we are really thinking about the two product offerings very symbiotically and synergistically," said Viernickel.

Robinhood, Salesforce and Palo Alto Networks are early CodeMinder customers and Google Chrome and YouTube teams are using the cybersecurity agent internally.