Google DeepMind has shared early results from CodeMender, an AI agent that automatically finds and fixes software vulnerabilities, Google DeepMind said in a blog post on 6 October 2025.
CodeMender is designed to be both reactive, patching new vulnerabilities as they appear, and proactive, rewriting existing code to remove whole classes of vulnerabilities.
In the six months it has been in development, CodeMender has upstreamed 72 security fixes to open-source projects, some as large as 4.5 million lines of code.
The agent uses Gemini Deep Think models together with tools including static and dynamic analysis, differential testing, fuzzing and SMT solvers. Special-purpose agents check its work, including an LLM-based critique tool that compares original and modified code to catch regressions.
Only patches that fix the root cause, are functionally correct, cause no regressions and follow style guidelines are passed to humans for review.