Google DeepMind introduces CodeMender, an agent that patches and hardens code, with 72 upstreamed fixes

Key facts

As stated in the sources, with where to find them.

• 72 security fixes upstreamed to open-source projects over the six months of development, including projects of up to 4.5 million lines of code.DeepMind post, introduction
• DeepMind said that, at announcement, every CodeMender patch was reviewed by human researchers before upstream submission.DeepMind post, 'Making software secure for everyone'
• CodeMender applied -fbounds-safety annotations to parts of libwebp; DeepMind says this would have made CVE-2023-4863, a heap buffer overflow a threat actor used in a zero-click iOS exploit, unexploitable.DeepMind post, 'Proactively rewriting existing code for better security'
• CSO Online reports that Google announced at I/O 2026 it is integrating CodeMender into its Agent Platform, with enterprise availability announced but not dated; CSO and an analyst it quotes note that no post-launch accuracy or regression data had been published.CSO Online, 2026-05-22

Findings that cite this record

No tracked finding cites this record yet.

Key questions this bears on

• Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. AI finds real vulnerabilities faster than they are fixed, and simple checks overstate how often AI patches work.

Sources

• Introducing CodeMender: an AI agent for code securityGoogle DeepMindOct 6, 2025Primary sourceAccessed Sep 25, 2026
• Google folds CodeMender into agent ecosystem amid push for AI-led AppSecCSO OnlineMay 22, 2026Secondary sourceAccessed Sep 25, 2026

Related records