DeepMind launches CodeMender, an AI agent for automated vulnerability fixes

Google DeepMind introduced CodeMender, an AI agent designed to find and automatically patch security vulnerabilities in software, built on its Gemini Deep Think models. Rather than only flagging vulnerabilities for a human to fix, CodeMender was built to produce the fix itself: it combines static and dynamic analysis, fuzzing and SMT solvers with a multi-agent structure in which specialised components identify root causes, propose patches, and validate that a fix does not break existing functionality before it reaches a human reviewer.

DeepMind said the project had been running for roughly six months before the public announcement, during which the agent had upstreamed 72 security fixes to open-source projects, including patches to codebases as large as 4.5 million lines. One example given was work on libwebp, an image-compression library at the centre of a zero-click exploit chain (CVE-2023-4863) used in real-world attacks on iOS devices; CodeMender applied memory-safety annotations intended to prevent that class of buffer-overflow vulnerability from being exploitable in future.

All patches went through human review before being submitted upstream, and DeepMind described the rollout to open-source maintainers as gradual and dependent on community feedback rather than an automated pipeline maintainers had no say over. The project positioned automated vulnerability remediation, rather than only vulnerability discovery, as an emerging application for frontier reasoning models — extending a trend of AI companies using their models’ code-analysis capabilities for defensive security work, in parallel with growing concern about the same capabilities being used offensively.