CodeMender

Programs consist of source code, that is, text that humans have written. This text almost always contains errors. Some of them are dangerous because attackers can exploit them to gain access to other people’s data. Such dangerous errors are called security vulnerabilities. CodeMender is a program by Google's subsidiary DeepMind that is meant to automatically find and fix exactly these kinds of vulnerabilities. It reads code, proposes a corrected version, and explains why this change fixes the problem.

Why security vulnerabilities arise faster than humans can close them

Large software projects comprise millions of lines of code. The Linux kernel, the core of many servers and Android phones, has over 30 million lines. No team can review that completely by hand. At the same time, the amount of code keeps growing every year.

Automated scanning tools already find a great many suspicious spots today. The problem comes after that: someone has to review every report and write a fix. This step is the bottleneck. In some projects, reported vulnerabilities remain unaddressed for months.

This is exactly where CodeMender comes in. It is meant not just to report issues but to deliver a ready-made fix suggestion right away. If that works reliably, it shortens the time window during which a vulnerability remains open and exploitable. According to Google, in the first few months it contributed around 70 such fixes to existing open-source projects.

From bug report to reviewed fix suggestion

At its core is a large language model from the Gemini family. This is an AI model that was trained on huge amounts of text and source code, giving it command of programming languages. However, CodeMender does not work with a single question-and-answer round. It is what’s called an agent: it is allowed to call tools itself, examine intermediate results, and make repeated revisions.

The process has several stages. First, the system analyzes the environment around the bug and searches for the actual root cause. This is often located in a completely different place than the crash itself. Then it writes a fix. After that, it runs the project’s existing tests to check whether everything still works.

A second model acts as a critic. It compares the old and new code and looks for side effects. If it finds any, the suggestion goes back for revision. Only once this internal check is passed does a human see the result. This final approval by developers is mandatory, because an incorrect fix could introduce new vulnerabilities.

CodeMender compared to Copilot and other code AIs

CodeMender cannot be used directly so far. It is not a product to download, but a research system that Google deliberately applies to selected open-source projects. Open source means that the source code is publicly viewable. Anyone using such software therefore benefits indirectly, without ever coming into contact with the system themselves.

CodeMender should not be confused with assistants like GitHub Copilot. These help with writing new code and suggest continuations as you type. CodeMender works the other way around: it takes finished code, often decades old, and repairs it. It also differs from pure scanning tools because it delivers the solution along with the finding.

In the news, the name usually comes up in connection with a broader debate. AI makes it easier for attackers to find security vulnerabilities. Systems like CodeMender are meant to help defense keep pace at the same speed. Whether that will work out remains open. Critics point out that automatically generated fixes could overwhelm the reviewers in open-source projects.