Google's New AI Doesn't Just Find Vulnerabilities — It Rewrites Code to Patch Them

Google’s DeepMind division unveiled an AI-powered agent called CodeMender that not only detects vulnerabilities but automatically patches and rewrites vulnerable code to stop future exploits. Since its development began, CodeMender has upstreamed 72 security fixes to open source projects, including some as large as 4.5 million lines of code.

Under the hood, it leverages Gemini Deep Think models to debug, flag, and fix root causes of security issues, while an LLM-based critique tool highlights differences between original and modified code to verify there are no regressions. The company said it plans to gradually engage maintainers of critical open-source projects to review CodeMender-generated patches and gather feedback.

According to DeepMind researchers Raluca Ada Popa and Four Flynn, CodeMender aims to enable developers to concentrate on building software by automatically creating and applying high-quality security patches. The development also coincides with Google’s AI Vulnerability Reward Program, offering rewards up to $30,000 for AI-related issues in its products.