Short answer: Google has added new controls to its AI tool, CodeMender, to help businesses secure their software more effectively. Businesses should now be able to isolate tests and verify vulnerabilities more safely.
TL;DR
- Google added new controls to CodeMender for better security.
- These controls help isolate tests and verify vulnerabilities safely.
- Businesses can now scan specific parts of their code for vulnerabilities.
- These updates aim to reduce the risk of zero-day exploits.
What happened at Google?
Google has improved its AI tool, CodeMender, by adding new security controls. These controls allow businesses to isolate tests and verify vulnerabilities more safely. They can now scan specific parts of their code, like a specific folder or only modified files, to optimize scanning speed and costs. The goal is to reduce the risk of zero-day exploits while keeping human oversight.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
Key facts
| Reported by | Help Net Security |
|---|---|
| Date reported | 05 Nov 2026 |
How it works
CodeMender is an AI tool that helps find and fix software bugs. It works by analyzing code and suggesting fixes. Users can run scans to detect vulnerabilities and simulate attacks in a safe environment.
- Analyze code for vulnerabilities
- Simulate attacks in a sandbox
- Check for local writes and commands
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-05 | Reported by Help Net Security | Help Net Security |
| 2026-11-12 | This Skillmate explainer published | Skillmate |
How to fix it
- If you have an account with the affected company, change that password and any reused copies of it.
- Turn on two-factor authentication (a second login step) wherever the service offers it.
- Expect phishing emails or calls that use the exposed details; verify requests through official channels.
How to detect it
Signs to watch for:
- Login alerts from new devices or locations on the affected account.
- Password-reset emails you did not ask for.
- Phishing messages that quote your real account details.
What is confirmed
- Reported by Help Net Security
- Reported by cloud.google.com
Why it matters
Companies can reduce vulnerability discovery time by over 95% with CodeMender. This helps protect software from attacks and saves time on manual checks.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is CodeMender?
CodeMender is an AI tool from Google that helps find and fix software vulnerabilities quickly, but it’s still in preview.
How does CodeMender work?
CodeMender isolates vulnerability verification and exploit simulation in a sandbox or virtual machine, adding human checks for local writes and command execution.
What are Gemini 4 Argon models?
Gemini 4 Argon models are part of Google’s AI tools that help identify and fix unknown vulnerabilities and generate tested patches.
Why are new controls needed for AI agents?
New controls are needed to ensure AI agents are used safely, preventing malicious exploits and zero-day testing issues.
Sources
- Google puts new limits on AI agents that hunt threats and fix vulnerabilities (Help Net Security)
- Google (primary source) (cloud.google.com)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
Watch today's video brief: https://youtu.be/yaK-CF987xg