Google Unveils CodeMender – An AI Agent That Automatically Fixes Vulnerable Code

Google has introduced CodeMender, an AI-powered agent designed to automatically detect and patch security flaws in software, announced on 6 October 2025 by Raluca Ada Popa and Four Flynn. It builds on Google’s prior vulnerability research such as Big Sleep and OSS-Fuzz and aims to move beyond finding zero-day flaws to creating and applying patches without manual intervention. Over the past six months, the research team has upstreamed 72 security fixes into open source projects, covering millions of lines of code.

CodeMender uses Google’s Gemini Deep Think models to reason about complex code, coupled with static and dynamic analysis, differential testing, fuzzing, and SMT solvers to trace root causes of flaws, orchestrated by a multi-agent system that critiques, debugs, and validates proposed fixes. All patches generated are reviewed by humans before being submitted upstream, and Google plans to collaborate with maintainers to refine the output.