An agent that proves a vulnerability by exploiting it, then patches it

Google DeepMind's CodeMender agent writes an exploit program to prove the existence of a security vulnerability, then generates its patch.

An agent that proves a security flaw is dangerous by actually attacking it, before fixing it itself: this is the premise of CodeMender, which Google is releasing in preview. Born from the work of Google DeepMind, the tool aims to automate not only the detection of software vulnerabilities, but also their remediation, the link in the chain that remains the slowest for security teams.

The process takes place in three steps. An initial scan spots the most common flaws, including subtle cases that escape standard analysis tools, across major programming languages. Then comes the distinctive step: to rule out false positives, the agent does not just report a defect, it creates proof of it, writing and running a small exploit program in an isolated test environment (a customer-managed sandbox) to confirm that the vulnerability is actually exploitable. Once the risk is proven, it proposes a patch ready for review, which a second AI checks to ensure it does not break anything in the application, with the final decision always resting with a developer.

In terms of deployment, the agent integrates into a company's development pipelines or runs locally, connects to code repositories, and is used with tools like VS Code, with data remaining isolated and not retained. CodeMender is also multi-model: users can choose the engine based on cost or the depth of analysis required, with integration of leading third-party models planned by the end of the year.