Google DeepMind Launches CodeMender AI to Patch Software Vulnerabilities

Google DeepMind has launched CodeMender, an AI agent designed to automatically identify and repair software vulnerabilities within open-source projects. Built on Gemini Deep Think models, the tool employs static analysis, fuzzing, and differential testing to determine the root causes of bugs and generate corresponding security patches.

Over a six-month period, CodeMender upstreamed 72 security fixes to various projects, including codebases containing up to 4.5 million lines of code. The agent functions both reactively, by patching known flaws, and proactively, by rewriting code to eliminate entire vulnerability classes. For example, it applied -fbounds-safety annotations to the libwebp image compression library to prevent buffer overflow attacks.

To prevent costly errors in code security, all AI-generated patches require human review before submission. Google DeepMind intends to expand testing with open-source maintainers before releasing the tool for broader developer use. The developers noted that software vulnerabilities are often difficult for humans to find and fix alone, even with traditional automated methods.