Google's CodeMender is now in public preview — and its most powerful variant is reserved for governments

Google Brings Its AI Vulnerability Agent to Enterprise Customers — With a Deliberate Catch

Google has moved CodeMender, its multi-agent tool for finding and fixing software vulnerabilities, into public preview on the Gemini Enterprise Agent Platform. Enterprise customers can start using it now, running on generally available Gemini models.

What makes this launch interesting is what Google is not making widely available. The model powering CodeMender’s most capable version, Gemini 3.5 Flash Cyber, is restricted to governments and trusted partners. It is not on the public roadmap in any broad sense, at least not yet.

What CodeMender Actually Does

CodeMender is a headless, autonomous security agent built on Google DeepMind research. It works in three stages.

First, it scans a repository for vulnerabilities including memory corruption bugs, injection flaws, and cryptographic weaknesses. It supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript.

Second, it tries to verify that each issue is real. It builds an exploit and runs it in a sandbox the customer controls. This step is specifically designed to cut down on false positives, which are one of the main reasons security findings pile up without being acted on.

Third, if the exploit succeeds, the agent writes a patch and returns it as a code diff for a developer to approve. Developers stay in the loop before anything gets committed, though the agent can also be wired into continuous integration pipelines if a team wants more automation.

The underlying architecture uses multiple agents running in parallel. Inside CodeMender, up to five sub-agents run simultaneously and their findings are merged into a single report. Google describes this as a deliberate design choice: rather than routing everything through one large model call, you run a cheaper model many times in parallel.

The Two-Tier Model Access

For most enterprise customers, CodeMender runs on standard generally available Gemini models, with Gemini 3.5 Flash as the default. Users can override this via a --model flag, with a few preview options available.

Gemini 3.5 Flash Cyber is the fine-tuned security variant that sits at the top of CodeMender’s capability stack. Google is not releasing this broadly. As Raluca Ada Popa and Four Flynn from DeepMind put it: “Given the dual-use nature of this technology, we have taken an intentional approach to how we deploy 3.5 Flash Cyber. As part of a limited-access pilot program, 3.5 Flash Cyber will be exclusively available to governments and trusted partners via CodeMender, expanding over time.”

The reasoning is straightforward. A model that is genuinely good at finding exploitable vulnerabilities and generating working exploits is also a model that could cause serious harm if misused. Google’s approach is to keep it inside CodeMender, where guardrails can allow defensive functions while blocking other activity. Because 3.5 Flash Cyber runs solely inside CodeMender rather than as a standalone API, those guardrails are structural, not just policy.

The benchmark numbers give you a sense of why the restriction exists. Tested against the V8 JavaScript engine, Gemini 3.5 Flash Cyber identified 555 unique confirmed issues. Gemini 3.5 Flash found 474. Claude Opus 4.6 found 363. Of the issues Cyber found, 101 were missed entirely by the other two models. In a practical test, Google’s Cloud Vulnerability Research team used the model to find remote code execution vulnerabilities in public APIs and a memory corruption flaw in a sensitive production service in about two hours.

What This Means for Enterprise Security Teams

If you are a Gemini Enterprise Agent Platform customer, CodeMender is available to you now in public preview. You can use it to scan your codebase, get verified vulnerability reports with working exploits as proof, and receive patches ready for review. Salesforce, Robinhood, and Palo Alto Networks are among the early enterprise testers.

Pricing will move to a consumption-based model on token usage once the product leaves preview, with model choices available to manage costs. Third-party frontier model support is also on the roadmap for later this year.

If your organisation is working with Google through AI Threat Defense, CodeMender sits within a broader stack that also includes Wiz for risk prioritisation and Mandiant for frontline expertise. In that configuration, the Wiz Green Agent orchestrates remediation workflows by directing CodeMender to generate patches enriched with context from Wiz’s Security Graph.

For everyone else, the Gemini 3.5 Flash Cyber variant is not currently accessible. Google’s position is that frontline defenders, meaning primarily national-level security organisations, should get the head start before the model’s capabilities are made more widely available.

The Underlying Problem CodeMender Is Trying to Solve

The gap between vulnerability discovery and patching has been widening. Discovery time, especially with AI-assisted tooling, is now measured in minutes to days. Patch development, testing, and approval still takes anywhere from 20 to 70 days in most organisations. That gap is where exploitation happens.

Automating the verification and patching steps addresses both ends of the problem. A verified vulnerability with a draft patch ready for review is a fundamentally different kind of security alert compared to a static analysis finding that may or may not be exploitable, and that requires a developer to understand the root cause before writing a fix.

Google has been running CodeMender against its own production environments to test and refine it. Customer source code is not used to train the underlying model weights, and session data is retained for up to seven days to allow interrupted scans to be resumed, then automatically deleted.

The public preview makes the core of this available now. The more capable version remains on a tighter leash, at least for the time being.