> ## Content Index
> Fetch the complete content index at: https://www.theleftshift.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Google DeepMind Launches ‘CodeMender’ — An AI Agent That Fixes Software Vulnerabilities Automatically
- URL: https://www.theleftshift.com/google-deepmind-launches-codemender-an-ai-agent-that-fixes-software-vulnerabilities-automatically/
- Published: 2025-10-08T06:32:57.000Z
- Updated: 2025-10-08T06:32:57.000Z
- Description: CodeMender can generate, validate, and apply high-quality security fixes.
- Author: The Left Shift Bureau
- Tags: AI Agents, Big Tech, AI News

DeepMind today [introduced](https://deepmind.google/discover/blog/introducing-codemender-an-ai-agent-for-code-security/?ref=theleftshift.com) **CodeMender**, an AI-powered agent designed to autonomously detect, patch, and proactively secure codebases against vulnerabilities. 

Unlike conventional tools that only flag flaws, CodeMender can generate, validate, and apply high-quality security fixes — helping developers focus on building rather than patching. 

"CodeMender helps solve this problem by taking a comprehensive approach to code security that’s both reactive, instantly patching new vulnerabilities, and proactive, rewriting and securing existing code and eliminating entire classes of vulnerabilities in the process," the company said.

Built on [Gemini](https://www.theleftshift.com/gemini-3-0-is-coming-and-it-might-be-googles-most-powerful-ai-yet/) Deep Think models, CodeMender is capable of reasoning about code, identifying root causes, and deploying patches with built-in validation checks. Over the past six months, it has already contributed **72 security fixes** to [open-source](https://www.theleftshift.com/cloudflare-open-sources-vibesdk-for-ai-powered-vibe-coding-platforms/) projects, including codebases as large as 4.5 million lines.

> Excited to share early results about CodeMender, our new AI agent that automatically fixes critical software vulnerabilities. AI could be a huge boost for developer productivity and security. Amazing work from the team - congrats!
> 
> — Demis Hassabis (@demishassabis) [October 7, 2025](https://twitter.com/demishassabis/status/1975551657514791272?ref%5Fsrc=twsrc%5Etfw&ref=theleftshift.com)

CodeMender operates via a tool-augmented workflow: it uses advanced programme analysis techniques — from static and dynamic analysis to fuzzing, differential testing, and SMT solvers — along with multi-agent critique modules to ensure patches don’t introduce regressions. Only the most vetted patches are surfaced for human review.

DeepMind describes the approach as both **reactive** (patching new vulnerabilities) and **proactive** (rewriting code to prevent entire classes of security flaws). One showcased example involved applying `-fbounds-safety` annotations to **libwebp**, which could have thwarted a prior buffer overflow exploit (CVE-2023-4863). 

DeepMind emphasises that CodeMender’s deployment is cautious. All proposed patches undergo human review, and its rollout to open-source maintainers is gradual.

Recently, AI startup [Anthropic published new research](https://www.theleftshift.com/anthropic-says-claude-outperforms-human-teams-in-some-cybersecutiry-tasks/) which shows Claude Sonnet 4.5 outperformed its predecessor Opus 4.1 in detecting vulnerabilities, patching code, and analyzing system security — even surpassing human teams in some cybersecurity competitions.