CodeMender vs Muse Code: The Security Specialist vs the Generalist Engineer

The two most-talked-about code agents of the past month come from opposite ends of the job description. CodeMender is Google's code-security agent: it finds a vulnerability, builds an exploit to prove it is real, and hands you a tested patch — and it will not build you a feature. Muse Code is Meta's terminal coding agent: it plans changes, writes code, and runs tools across a whole repository — and it will not prove that a vulnerability it happens to spot is actually exploitable. They get lumped together because both are new, both are called "coding agents," and both entered the product world within weeks of each other. This piece is about the question that framing skips: which one does your team actually need? The honest answer is that they do not compete so much as cover two halves of the same software-development pipeline.

The availability gap is the first place the two diverge, and it is not subtle. One of them you can have tonight: Muse Code is a public beta that installs with a single curl command on macOS and Linux and bills per token as you go. The other you have to ask for: CodeMender entered public preview on Google Cloud on July 22, 2026, as a managed agent on the Gemini Enterprise Agent Platform and inside Google's AI Threat Defense, access is granted through Google Cloud sales, and preview use is explicitly for testing and evaluation rather than production workloads. Its most security-tuned engine — the Gemini 3.5 Flash Cyber model that runs inside CodeMender — is gated further, available only to a small set of governments and trusted partners in a limited pilot. So for the next several months the practical comparison is not "specialist vs generalist"; it is "the one you can run today vs the one you must request."

CodeMender: a managed security agent, not a model you call

CodeMender began as a DeepMind research project announced on October 6, 2025, and its origin story is what makes the July preview believable: in its first six months the research prototype upstreamed 72 security fixes to open-source projects, including codebases as large as 4.5 million lines of code, with every patch validated across multiple dimensions and reviewed by a human before submission. The most-cited example is its work on libwebp, the widely used image library: CodeMender added C bounds-safety annotations that, Google says, would have made the CVE-2023-4863 heap buffer overflow — the one used in a zero-click iPhone exploit — unexploitable.

As a product, CodeMender is a three-stage loop. Scan: it hunts for the top vulnerability classes — memory corruption, injection, web-security issues, cryptographic flaws, insecure data handling — across C/C++, Go, Java, Python, Ruby, Rust, and TypeScript, using a harness that reads the repository's own context, goals, and conventions. Verify: this is the step that separates it from every general-purpose coding agent. CodeMender writes a proof-of-concept exploit and runs it in an isolated, customer-managed sandbox, so a finding only surfaces if it is demonstrably exploitable — which is how it attacks the two problems security teams actually drown in: false positives and alert fatigue. Remediate: the verified fix is delivered as a code diff, checked by an LLM-as-a-judge for functional equivalence so it doesn't break application behavior, matched to the codebase's style if you provide the conventions, and merged only with human approval.

The model story matters for this comparison because it is the one part of CodeMender you can touch without the product. The enterprise preview runs on Google's generally available Gemini models — teams pick between Gemini 3.5 Flash, Gemini 3.1 Pro, and Gemini 3 Flash to balance cost, speed, and scan depth — with third-party frontier models planned later this year. The gated Gemini 3.5 Flash Cyber variant is the specialist-of-the-specialist: Google reports it at 83.2% on the CyberGym benchmark, and at 55 unique confirmed issues in the V8 JavaScript engine versus 47 for mainline Gemini 3.5 Flash and 36 for Claude Opus 4.6 in Google's own testing. Those are all vendor-reported figures for a model outside researchers cannot run, so treat them as directional until an independent evaluation exists.

Muse Code: a generalist engineer in your terminal

Muse Code shipped as a public beta on August 5, 2026, and it answers a different question. It is a terminal coding agent, not a security tool and not a hosted model: you install it with one command on macOS or Linux and it plans, writes, and validates code across large repositories, powered by Meta's co-trained Muse Spark 1.2 reasoning model. Its headline design choices are about long-horizon autonomy: persistent background agents that stay alive across a session instead of being spawned per task, a crash-safe append-only event log that makes the runtime replay-exact and restart-safe, and built-in skills — /plan turns a task into an approval-gated plan, /grill stress-tests that plan, /goal drives toward completion of the objective.

Where CodeMender's differentiator is the verify step, Muse Code's is breadth. It will happily write a security patch if you point it at a known vulnerability — it reads code, it reasons about buffer overflows, and by its own numbers it is strong at agentic coding in general. What it will not do is build an exploit and run it in a sandbox to prove the flaw is exploitable. There is no security verification loop, no exploitability evidence, no judge checking that a security fix preserves behavior. Pointed at a security task, it is a capable engineer with no security-specific quality gate; CodeMender is a security pipeline that happens to run on frontier models.

The benchmarks you cannot compare

This is where most coverage of these two falls apart, so let's be explicit. CodeMender's flagship number is 83.2% on CyberGym, a benchmark for finding and fixing real vulnerabilities, and Google's figure is vendor-reported with no independent reproduction because the Flash Cyber model itself is gated. Muse Code's flagship number is 82.9% on Terminal-Bench 2.1, Meta-reported, second only to Claude Code on Opus 5 at 86.7% and ahead of GPT-5.6 Terra on Codex at 81.8%; Meta also reports 59.3% on DeepSWE 1.1, an agentic-coding benchmark. The two scores look close and they measure different jobs: 82.9% on Terminal-Bench says "solves general terminal coding tasks," while 83.2% on CyberGym says "finds and fixes exploitable vulnerabilities." Neither agent has a score on the other's benchmark, so you cannot subtract one from the other — and an honest comparison should say that out loud rather than printing both numbers side by side and letting the reader do the subtraction.

One more number is worth flagging because it changes how you read a press release. Meta presents the 82.9% as a +6.7-point gain over its own Muse Spark 1.1, which would put the earlier model at 76.2% — and 76.2% is exactly what the independent Terminal-Bench leaderboard shows for Muse Spark 1.1 (tbench.ai, high effort, mini-SWE-agent harness, July 2026). That coincidence is suggestive, not proof, but it implies Meta's generational delta spans a model upgrade and a harness upgrade in one number: the new model plus its co-trained agent scaffold, measured against an older model on a minimal third-party scaffold. Take the 82.9% as a real vendor-reported result; take the "+6.7 over the old model" as the part that is less controlled than it looks.

Price: one of them has a price sheet

This is where the two could hardly be more different, and it changes the decision more than any benchmark. Muse Code has published per-token pricing in two tiers. Standard tier: $1.25 per million input tokens, $0.15 per million cached input, $4.25 per million output — byte-for-byte the same prices as Muse Spark 1.1's API, so the agent charges no premium over its underlying model. Contributor tier: $0.10 input, $0.002 cached, $0.20 output — roughly 12x to 75x cheaper — in exchange for Meta's right to use the data to improve its products. That tier deserves the treatment it rarely gets: a coding agent reads your repository, so contributor-tier prompts are full of source code, internal APIs, and test fixtures. It is a data-licensing decision, not a billing one.

CodeMender has no price sheet at all. Google has not announced pricing for the managed preview — it is a request-through-sales, testing-and-evaluation-only offer, and the reasonable expectation in coverage is consumption- or token-based billing once it reaches general availability, but that is not a published number and we won't invent one. You cannot compare "$1.25 input" to "ask your Google Cloud rep," and pretending otherwise is how these comparisons go wrong.

The honest middle ground is the models behind the agents. Neither CodeMender nor Muse Code is hosted on OrcaRouter — they are products, not callable models, and we don't imply otherwise. But the engines both run on are: Gemini 3.5 Flash, the default GA model inside CodeMender's enterprise path, is on OrcaRouter at Google's list price of $1.50 input / $9.00 output per million tokens with 0% markup, and Muse Spark 1.1, whose API prices Muse Code's standard tier copies exactly, is on OrcaRouter at $1.25 / $4.25. If what you want is hands-on experience with the models behind two agents that are respectively gated and beta, one API at list price is the cheapest and fastest way to get it — and because our markup is zero, a vendor price cut is live here the same day it is announced. The price sheet moves; the agent's preview terms don't.

Quién debería elegir cuál

Pick CodeMender if your bottleneck is the vulnerability-to-tested-fix pipeline at scale. The pattern shows in Google's early customers — Robinhood reports it "consistently identified critical vulnerabilities that our other AI-enabled tools completely missed," Salesforce frames it as accelerating the path from validated vulnerability to tested fix, Palo Alto Networks as closing the loop from detection to fix without losing velocity. Those are vendor-published endorsements, so take them as what they are: marketing-grade proof that the product works on real codebases, not a controlled evaluation. The fit is a security team that wants exploit-proof evidence and machine-speed remediation and can get into the preview.

Pick Muse Code if you want a general engineer in the terminal today, on any repository, at a published price. It will not patrol your codebase for memory-corruption bugs or prove exploitability — you are the security gate, and you should budget for that. But for feature work, large-repo autonomy, and a crash-safe runtime for long tasks, it is the available-now option with numbers on its own benchmark.

Most product-security orgs will land on "both, at different layers": Muse Code (or another generalist) for the engineering, CodeMender for the security loop once the preview opens up. They are not substitutes. Choosing one because the other is unavailable is a real constraint, not a verdict on the tools.

CodeMender and Muse Code are the same category the way a surgeon and a general practitioner are the same category: both practice medicine, and you would not ask one to do the other's job. Meta's agent is the one you install and put to work tonight; Google's is the specialist you request, with the quality gate — build the exploit, prove the risk, ship the tested patch — that makes it the only one of the two that closes the loop from "we have a finding" to "here is the fix, verified." Right now the honest summary is a division of labor, not a winner.