CodeMender Goes Managed: Google's Vulnerability-Fixing Agent Hits Public Preview

For the first eight months of its life, CodeMender was Google DeepMind's quietest successful product: an AI agent that finds real software vulnerabilities and ships real patches — 72 of them merged into open-source projects before the project had a price. On July 21, 2026, it became something else: a managed, enterprise-grade product in public preview on Google Cloud, running on a multi-model stack anchored by Gemini 3.5 Flash, and backed for its deepest scans by a security-tuned model — Gemini 3.5 Flash Cyber — that Google restricts to governments and trusted partners.

This is not a model launch, so let's be precise about the dates. CodeMender dates to October 6, 2025, when Google DeepMind introduced it as a research project built on Gemini Deep Think reasoning. What actually changed in the last few weeks is the productization. The agent that operated as an internal research pipeline with human review is now a managed agent any Google Cloud customer can adopt in public preview, with consumption-based pricing promised once preview ends. That transition — from research project to buyable product, and the gated model that powers it — is the news.

What changed on July 21

Google Cloud took CodeMender from research to managed agent in one move on July 21, 2026. It is now available in public preview on the Gemini Enterprise Agent Platform, and it can be deployed as a core component of Google's AI Threat Defense, alongside Mandiant and Wiz. That placement matters: this is not a standalone demo tool, it's an agent designed to slot into an existing security organization's tooling and approval flows.

The managed version is explicitly multi-model, and this is the part that reads like a router's spec sheet. Teams choose between Gemini 3.5 Flash (the default, for balance of cost, speed and scanning depth), Gemini 3.1 Pro for deeper analysis, and Gemini 3 Flash for higher-throughput scans. Google says third-party frontier model options arrive later in 2026. Language coverage spans C, C++, Go, Java, Python, Ruby, Rust, and TypeScript/JavaScript, with framework awareness for Django, Flask, React, Spring Boot, and Express.

How the managed CodeMender actually works

The pipeline is a three-stage loop: scan, verify, remediate. It sounds simple; the design decisions are what separate it from a linter with an LLM bolted on.

Scan. CodeMender uses the model's contextual understanding of a codebase to find vulnerabilities that static analysis tools miss — memory corruption, injection flaws, cryptographic weaknesses, insecure data handling. The agent reasons over execution paths rather than pattern-matching on signatures.

Verify. This is the step that most "AI security" products skip. CodeMender builds and runs a proof-of-concept exploit in an isolated, customer-managed sandbox to confirm a finding is genuinely exploitable before it ever reaches a developer. Google's own framing is that this collapses the false-positive rate, which is the reason security teams historically distrust automated scanners.

Remediate. It generates a code diff with an LLM-as-a-judge step that checks the fix against organizational rules and business logic before anything is surfaced. Every patch still requires a human to approve it before it reaches the repository — the human-in-the-loop discipline from the research era carried over intact.

Operationally, Google lists secure traffic routing through customer VPCs, data isolation, encryption, and zero retention of source-code data as available at preview. For a tool that processes proprietary source code, that control set is the actual enterprise feature.

The gated engine: Gemini 3.5 Flash Cyber

The deepest scans inside CodeMender are powered by Gemini 3.5 Flash Cyber, a model Google announced on July 21, 2026, fine-tuned on top of Gemini 3.5 Flash specifically to find, validate, and patch vulnerabilities. It is not a general-purpose model and it is not for sale in any conventional sense. Access runs through a limited-access pilot restricted to governments and vetted trusted partners via CodeMender, with broader access planned over time and no firm timeline. There is no public API, no self-serve signup, and no published price — Google describes it as cost-efficient and priced comparably to standard Gemini 3.5 Flash rather than like a premium security model, but that is a claim about intent, not a rate card.

How CodeMender uses it is notable: the agent invokes Gemini 3.5 Flash Cyber multiple times — Google has described configurations calling it up to five times for a single final report — so sub-agents analyze many more code paths across a large codebase than one pass of a big model would allow, then consolidate findings. That "many cheap calls beat one expensive call" design is the cost-engineering story underneath the benchmark headlines.

The headline numbers are all vendor-reported, and that distinction is the whole game with this model. On Google's own evaluation against the V8 JavaScript engine, Gemini 3.5 Flash Cyber found 55 unique confirmed issues versus 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6 — including 10 issues neither other model caught. On Big Sleep-style evaluations over complex codebases like Chrome and Safari, Google claims it "significantly surpassed" the mainline Flash models, and in Google's own production use it uncovered remote-code-execution vulnerabilities in public APIs and a memory-corruption flaw in a sensitive production service within two hours — and, at one point, generated a 100% reliable RCE exploit that bypassed ASLR and W^X mitigations. That last finding is precisely why the model is gated.

What you can verify versus what's vendor-reported

It is worth separating the ledger, because every figure above traces back to Google. The one benchmark with meaningful outside provenance is CyberGym, a dataset of roughly 1,500 documented vulnerabilities across about 188 real open-source projects, built by Google's Big Sleep team in collaboration with academic researchers. On CyberGym, press analysis placed Gemini 3.5 Flash Cyber at about 83.2 percent — tightly clustered with OpenAI's GPT-5.5-Cyber at 85.6 percent and Anthropic's Mythos 5 at 83.8 percent. Google itself only claimed "competitive performance against significantly larger models," which reads as an accurate description of a three-way near-tie.

Everything else — the V8 counts, the Big Sleep comparisons, the Chrome commit-scanning uplift — is Google grading its own model against baselines Google chose, inside codebases Google controls. That does not make the results false. It makes them unreproducible, because the model is gated: no outside researcher can run it, so there is no independent confirmation to point to. Treat the 55-issue V8 number as a strong vendor signal, not a verified fact.

Price, access, and who's using it

For most readers, the practical question is "can I use this?" Right now, the honest answer is: not directly. CodeMender is in public preview for Google Cloud customers via the Gemini Enterprise Agent Platform and AI Threat Defense, and Google has not published pricing — the stated plan is consumption-based billing on token usage after preview. Gemini 3.5 Flash Cyber is narrower still: pilot-only, gated to governments and trusted partners, with a human approval step before any patch ships.

The customer list Google has named — Salesforce, Robinhood, and Palo Alto Networks among the public testers, with Chrome, Android, Cloud, Ads, and YouTube using it internally — indicates the intended buyer is a security organization, not an individual developer. Within AI Threat Defense, Wiz will be able to call CodeMender to scan code, with Wiz's Green Agent orchestrating remediation.

What it means if you build on models

The design detail that keeps surfacing is the multi-model pattern: pick Gemini 3.5 Flash for routine scans, Gemini 3.1 Pro when the analysis is deep, Gemini 3 Flash when volume is high, and a specialist model when you need it. That is routing — the same decision a model router generalizes across a catalog, exposed per request instead of hard-coded into one product.

CodeMender and Gemini 3.5 Flash Cyber are not models you can call from an API today, and we don't route them. But the default engine inside CodeMender — Gemini 3.5 Flash — is a model teams can call right now. It's on OrcaRouter at the provider list price, $1.50 per million input tokens and $9.00 per million output, passed through with 0% markup, alongside 200+ other models behind one API. If you want to build a scan-and-triage workflow today with a generally available frontier model under your own guardrails, that is the practical route — and if you want to test a newer or unproven security model against your codebase without betting a production pipeline on it, routing with automatic failover lets you switch models with one key and no second contract.

Bottom line

CodeMender going managed is a real milestone for the AI-security category: a vulnerability-fixing agent with a production track record, wrapped in enterprise controls, priced on tokens, and fronted by a model so effective at offensive work that Google chose to lock it down rather than sell it widely. For security teams inside Google Cloud, the preview is worth a serious look — the scan-to-patch loop with sandbox verification is genuinely ahead of the scanner-plus-LLM status quo.

For everyone else, the practical takeaway is unchanged by the announcement: the capability is gated, but the engine under it — Gemini 3.5 Flash-class reasoning — is available today through ordinary APIs, and the routing pattern CodeMender bakes in is something you can adopt yourself. Watch for two things in the coming months: the consumption-based pricing sheet when preview ends, and whether Google opens the Gemini 3.5 Flash Cyber pilot beyond governments and trusted partners. Either would be the next real signal in this story.