Google DeepMind’s New AI Agent Finds and Fixes Vulnerabilities

Google DeepMind’s latest AI agent, CodeMender, is designed to autonomously find and patch security vulnerabilities in code, building on earlier work such as its Big Sleep agent that reportedly discovered a critical SQLite vulnerability and thwarted in-the-wild exploitation. DeepMind says CodeMender can rewrite and secure existing code to eliminate entire classes of security bugs and includes checks to prevent regressions or other issues.

The system can reason about code, validate changes through advanced program analysis and multi-agent systems, and uses static and dynamic analysis, fuzzing, differential testing, and SMT solvers to identify root causes and architectural weaknesses. It employs special-purpose, multi-agent components, including a large language model-based critique tool that highlights differences between original and modified code to verify changes and self-correct as needed.

Over the past six months, CodeMender has provided 72 security fixes to open source projects, with all patches reviewed before submission, and Google notes the effort aims to keep pace with growing software complexity.