Google launches CodeMender and Gemini 3.5 Flash Cyber to uncover vulnerabilities

Google has introduced CodeMender as a managed agent for code security and has paired the initiative with Gemini 3.5 Flash Cyber, a model designed to find, validate, and fix vulnerabilities before they can be exploited. The proposal is not limited to scanning: the system can also build and run exploits in customer-controlled sandboxes to verify whether a flaw is truly exploitable. The goal is to shift part of the research and triage work from people to automated systems, while still maintaining a validation and governance perimeter. It is an important move because Google is trying to turn AI into a concrete defensive tool, not just a development assistant. At the same time, the fact that the model is capable of generating controlled exploits shows how thin the line between defense and offensive capability has now become. For security teams, the question is no longer whether to use these tools, but how to adopt them without losing control and verifiability.

Sources

• Google’s Gemini 3.5 Flash Cyber becomes a vulnerability hunter — Help Net Security
• Google Makes CodeMender Available as Managed AI Security Agent — Infosecurity Magazine