Skip to content

Back to the catalog

deepmind.googlearticle

CodeMender (Google DeepMind)

Google DeepMind's official announcement of CodeMender, an AI agent built on Gemini Deep Think that autonomously debugs, roots-causes, and patches security vulnerabilities in real codebases, then validates fixes via static and dynamic analysis, differential testing, fuzzing, SMT solvers, and an LLM-based critique agent before human review. The team has upstreamed 72 security fixes to open-source projects, including some spanning 4.5 million lines of code, and used CodeMender to proactively apply bounds-safety annotations to libwebp, which would have neutralized the buffer-overflow class of bug behind CVE-2023-4863, a bug used in a zero-click iOS exploit.

TL;DR DeepMind's CodeMender is an autonomous Gemini-powered agent that finds, patches, and validates security vulnerabilities, already upstreaming 72 fixes including bounds-safety hardening for libwebp's CVE-2023-4863 class of bug.
Open original ↗

CVEs named here

Technologies named here

Techniques named here

  • Heap buffer overflow exploitation
  • Zero-click iOS exploit
  • Object lifetime vulnerability exploitation

Related in AI Security