Now in preview: Find and fix software vulnerabilities with CodeMender

Google is putting CodeMender into preview so teams can use its scanning and remediation features directly. The product is Google’s managed code security agent. The move sits against a backdrop of adversarial AI that is speeding up attacks on software, which is why Google frames the response as machine-speed defense: automate remediation and fight AI with AI.

CodeMender is built around two linked jobs: find vulnerabilities in code, then fix them. As a managed agent, it is meant to run as an operational service rather than a one-off scanner report. Scanning surfaces issues; remediation is intended to generate or apply fixes so the loop does not stop at detection. Exact architecture, model stack, language coverage, and fix-acceptance workflow are not spelled out in the announcement beyond that scanning-plus-remediation scope.

For engineers and security builders, the useful signal is the shift from human-paced triage to agent-driven remediation under AI-accelerated attack pressure. If scanning and fix proposals land in the same product surface, review queues, patch SLAs, and ownership between AppSec and product engineering all change. Teams that already automate CI checks will care whether CodeMender’s fixes plug into existing PR and policy gates or create a parallel path that still needs human sign-off.

In market terms, this is Google Cloud positioning a managed security agent for code, not only a static analysis checkbox. Competitors across cloud security, AppSec platforms, and AI coding tools are racing to combine detection with automated repair. Preview access is how Google tests product-market fit for that combination while demand for AI-scale defenses rises.

What to watch next: how preview users evaluate fix quality and false-positive rate, whether remediation is suggested-only or can apply changes under policy, and how CodeMender sits next to existing Google Cloud security and developer tooling. Until those mechanics are public, treat the launch as a capability claim—managed agent, scan plus remediate, preview—not a finished ops playbook.