Google enhances vulnerability-fixing AI CodeMender using multiple AI models

Google has strengthened its AI CodeMender, which discovers and fixes software vulnerabilities. On November 4, the company announced improvements that allow users to select a sandbox or a virtual machine for vulnerability verification, as well as to choose the scope of files to investigate. CodeMender is currently available in a preview version. The verification environment can be a sandbox, which limits program operation using OS features, or a virtual machine, which creates an independent computer virtually. This allows execution of vulnerability verification and attack reproduction in a controlled environment, reducing risks if problems occur during verification.

Additionally, a system has been added to require human confirmation for writing files or executing commands in the local environment. Users can choose from three options for the investigation scope: specific folders, entire repositories, or only files changed since the last investigation. By narrowing down targets as needed, time and costs for investigations can be reduced. CodeMender utilizes several AI models, including Google's Gemini 4 Argon. It aims to identify previously unknown vulnerabilities and generate verified fixes before they can be exploited by attackers.