Google's CodeMender writes the patch. You still review it.

Most vulnerability scanners hand you a list and leave. Google's CodeMender went into public preview on July 21, 2026 with a different loop: find the flaw, write a proof-of-concept exploit to confirm it's actually reachable, then generate a tested patch and put it in front of a human. That middle step is the interesting one, and it's also the one that changes what you need to think about before turning it on.

What actually happened

Google Cloud shipped CodeMender in preview through two doors: the Gemini Enterprise Agent Platform, or as a component of Google AI Threat Defense. Preview language coverage is C, C++, Go, Java, Python, Ruby, Rust, and TypeScript/JavaScript, plus common enterprise frameworks.

The exploitability check runs in an isolated, customer-managed sandbox. Read that phrase carefully — the agent is generating and executing exploit code inside infrastructure you own and pay for, not Google's. That's the right architecture for keeping your source out of a vendor's execution environment, and it's also a new thing in your account that runs adversarial code against your own software.

Two more details from the rollout. The variant paired with Gemini 3.5 Flash Cyber — the model tuned specifically for vulnerability work — is restricted to a small set of governments and trusted partners. Everyone else gets CodeMender running on generally available Gemini models. And Google says third-party frontier model options are coming later this year, which is worth noting if you're trying not to hard-wire one vendor into your security tooling.

Why an AI patch agent matters for your codebase

The value here isn't "AI finds bugs." Static analysis has found bugs for twenty years and mostly produced a backlog nobody reads. The value is triage: a finding that comes with a working proof-of-concept is a finding you can prioritize honestly, and one that fails to reproduce is noise you can close without a meeting.

The risk is the other half. A patch that compiles and passes tests is not a patch that's correct — it's a patch that didn't get caught. Security fixes are exactly where a plausible-looking change can silently alter behavior at a boundary. So the review gate stays human, and it should be a security-aware reviewer, not whoever's on rotation. Treat CodeMender output like a PR from a fast contractor who's never read your architecture docs.

Practical setup: scope the sandbox project tightly with its own service account and no path to production, start it on one repo rather than the whole org, and require a signed-off human review before any generated patch merges. If you already have branch protection and CODEOWNERS, you mostly already have the control — just don't carve an exception for the robot because its PRs are green.

Sources: Google Cloud Blog, Infosecurity Magazine.