gcp Google Cloud Blog ·

CodeMender preview: AI-powered code vulnerability scanning and remediation

blogsecuritygcpgapreviewengineergovernment
feature announcement

Google Cloud is releasing CodeMender, a managed code security agent, in preview. This tool uses AI to scan for and automatically remediate software vulnerabilities, aiming to reduce security risks and speed up remediation. It is designed for security teams and developers working with various programming languages and integrates with CI/CD workflows. Availability is currently in preview, with wider access planned.

  • CodeMender agent offers AI-driven code scanning and remediation
  • Flexible model deployment for optimized scanning performance
  • Automated remediation and exploitability prioritization
  • Integration with existing security workflows and development tools
  • CodeMender integrated into AI Threat Defense
Features (5)
  • CodeMender agent offers AI-driven code scanning and remediation

    CodeMender is a new managed code security agent available in preview, designed to automatically scan software for vulnerabilities and remediate them using AI. It aims to accelerate the process of finding and fixing code flaws, reducing zero-day risks.

  • Flexible model deployment for optimized scanning performance

    CodeMender supports a multi-model approach, allowing users to choose from various models, including Gemini Enterprise Agent Platform, to optimize for cost, speed, and deep scanning performance. Third-party model options are expected later this year.

  • Automated remediation and exploitability prioritization

    The agent can automatically generate and test code fixes for verified vulnerabilities, while also prioritizing fixes based on simulated exploitability. This helps reduce manual remediation bottlenecks and focuses resources on the most critical issues.

  • Integration with existing security workflows and development tools

    CodeMender is built on Google DeepMind's AI research and operates within the secure Agent Platform. It can integrate with CI/CD pipelines, local development environments via a CLI client, and connect to code repositories, working with tools like VS Code.

  • CodeMender integrated into AI Threat Defense

    When used with AI Threat Defense, CodeMender scans code, enriches findings in the Wiz Security Graph, and triggers AI pentesting to prove exploitability. This integration streamlines the application security lifecycle and remediation process.

Notes (1)
  • Limited availability for specific models

    CodeMender with Gemini 3.5 Flash Cyber will initially be available to a select group of government and trusted partners, with plans to expand access over time. General access to CodeMender is currently in preview.

Read the original announcement →

https://cloud.google.com/blog/products/identity-security/find-and-fix-software-vulnerabilities-with-codemender/

Related releases