Google DeepMind Tests AI Agent That Automatically Fixes Code Vulnerabilities
Arkadiy Andrienko
Google's DeepMind division has revealed the findings from its latest research project: a system called CodeMender, capable of independently finding and fixing software vulnerabilities. Unlike tools that only flag problems, this AI agent generates patches. For now, the project remains a research initiative, but it's already delivering practical outcomes. CodeMender has produced over 70 fixes for open-source projects, with some of these patches addressing codebases exceeding 4.5 million lines.
The developers note that the system's goal isn't just to react to identified flaws but to rewrite code in a way that prevents entire classes of vulnerabilities from emerging in the future. One example cited is its work on the libwebp library, which was involved in a major iOS attack in 2023. CodeMender automatically added specific annotations to its code, which researchers say permanently block the exploitability of buffer overflow vulnerabilities.
The fixing process isn't a simple matter of swapping a few lines of code. The system uses a suite of tools, including static analysis and fuzzing, and a dedicated "judge" module verifies that the applied fixes don't break the program's original logic.
Critically, all changes generated by the AI are mandatorily spot-checked by human developers before being submitted to the original code authors. This process minimizes risks and serves as additional training for the neural network itself.
If the project progresses beyond the research stage, it could fundamentally change how software security is handled. Traditional methods find security "holes," but patching them still requires significant human effort. CodeMender offers a path toward automating this process, which is becoming critically important as the volume and complexity of modern code continue to grow.
