CodeMender autonomously patches vulnerabilities in open source

Google DeepMind on Monday published early research results for CodeMender, an AI agent that autonomously finds, patches and rewrites vulnerable software code, and said that during six months of testing it has upstreamed 72 security fixes to open source projects, including codebases of up to 4.5 million lines. The project is presented as both a reactive tool that applies immediate patches for newly discovered flaws and a proactive system that rewrites existing code to remove entire classes of vulnerabilities.

CodeMender pairs the reasoning capabilities of Gemini Deep Think models with program analysis techniques such as static and dynamic analysis, fuzzing, symbolic reasoning and targeted debugging. The system uses a suite of specialized tools that let it trace root causes, propose fixes and validate changes automatically. An LLM-based judge evaluates whether a proposed patch preserves functionality and adheres to style guidelines, and the agent can self-correct when validation detects problems. DeepMind said every patch generated by CodeMender is reviewed by human researchers before submission to upstream projects.

Researchers described examples in which the agent identified...