Google DeepMind's new AI patches critical code bugs on its own

AI is finding zero-day vulnerabilities faster than human maintainers can patch them. Google is now deploying AI to fight back.

Google DeepMind just introduced CodeMender, an autonomous AI agent designed to automatically track down, fix, and rewrite insecure code in major software projects.

Over the past six months, CodeMender has already upstreamed 72 security fixes to open-source codebases, including massive repositories with more than 4.5 million lines of code.

Finding root causes instead of slapping on quick band-aids

Most automated security tools simply flag errors or patch obvious surface crashes. CodeMender goes deeper by leaning on the reasoning power of Gemini Deep Think models.

When a bug report shows a heap buffer overflow, the actual bug might be a faulty stack operation buried deep inside an XML parser. CodeMender uses static analysis, dynamic testing, and theorem provers to isolate the real root cause rather than treating the symptom.

It also doesn't just guess code and hope for the best. DeepMind built a multi-agent critique system that acts like an automated code reviewer.

When CodeMender drafts a patch, a dedicated reviewer agent checks for functional equivalence and regressions. If a build breaks or a unit test fails, the agent self-corrects until the patch is clean enough for human review.

Rewriting legacy code before attackers find it

Fixing known bugs is only half the battle. CodeMender is also built to proactively modernize fragile codebases.

DeepMind deployed the agent on libwebp, the ubiquitous image compression library behind CVE-2023-4863, a notorious flaw once weaponized in zero-click iOS exploits.

Instead of waiting for a crash, CodeMender automatically annotated sections of libwebp with bounds-safety attributes. These annotations instruct compilers to insert runtime bounds checks, effectively eliminating entire classes of buffer overflow exploits forever.

For now, Google is keeping humans in the loop. Every CodeMender patch is reviewed by a security engineer before being submitted upstream, though Google plans to eventually roll it out broadly to external developers.

Why it matters

Open-source infrastructure is famously held together by overworked volunteers. As automated discovery tools like Big Sleep make zero-days easier to unearth, maintainers are facing an asymmetrical defense problem.

We think CodeMender is a practical shift in the AI arms race. While code generation assistants get all the consumer hype, applying autonomous reasoning to low-level memory safety and regression testing delivers far more concrete enterprise value.

That said, the stakes in code security are unforgiving. A subtly flawed automated patch could quietly introduce a new vulnerability across millions of downstream machines. Keeping humans in the approval chain makes sense today, but scaling this tool industry-wide will require developers to trust an agent with the most sensitive parts of their codebase.