Google has developed specialized agentic AI systems, including CodeMender and Gemini 3.5 Flash Cyber, to automatically find, validate, and patch software vulnerabilities across massive codebases. These AI agents operate at machine speed to address the growing gap between how quickly vulnerabilities are discovered and how quickly human teams can remediate them.
What happened: Google DeepMind introduced CodeMender in October 2025 as an AI-powered agent for automated code security, followed by Gemini 3.5 Flash Cyber in July 2026, a specialized model designed to rapidly identify and fix software flaws.
What is agentic AI: Unlike chatbots that generate text, agentic AI systems can plan, reason, use tools, and execute multi-step workflows autonomously within defined boundaries.
Why code security is difficult at scale: Modern codebases contain millions of lines of interdependent code. Finding vulnerabilities requires tracing complex execution paths, understanding context, and prioritizing fixes — work that overwhelms human security teams.
Why Google's approach matters: Google has deployed these systems across its own production codebases including Chrome, Android, Cloud, Ads, and YouTube, demonstrating real-world operational impact rather than theoretical research.
What Is Agentic AI?
Agentic AI refers to artificial intelligence systems capable of performing multi-step tasks autonomously, using reasoning, planning, tool invocation, and context awareness to achieve defined goals.
Traditional AI assistants respond to individual prompts. Generative AI produces fluent text or code from instructions. Agentic AI goes further: it maintains goals across extended tasks, decides which tools to use, evaluates results, and iterates until a task is complete.
Key characteristics of agentic AI include:
- Goal orientation: The system pursues a defined objective rather than just responding to queries
- Autonomy: It can initiate actions without step-by-step human instruction
- Adaptability: It adjusts its approach based on intermediate results
- Tool usage: It can call external tools, APIs, and analysis systems
- Multi-step reasoning: It breaks complex problems into manageable sub-tasks
Security technologist Bruce Schneier described the promise of agentic AI as "an assistant, an AI that uses tools in a loop."
Why Is Securing Hundreds of Millions of Lines of Code Difficult?
Securing massive codebases presents challenges that scale exponentially with size and complexity.
Codebase size and complexity. Google's production systems contain hundreds of millions of lines of code across countless interconnected services, libraries, and applications. A single vulnerability can hide in a rarely-executed code path that only manifests under specific conditions.
Constantly changing code. New code is committed continuously, and every change can introduce new vulnerabilities or expose existing ones. Manual security review cannot keep pace with development velocity.
Dependencies and legacy systems. Modern software relies on extensive third-party libraries and legacy components. Vulnerabilities in dependencies can affect thousands of applications simultaneously.
Vulnerability discovery versus remediation. AI systems now find vulnerabilities faster than human teams can fix them. This creates a growing backlog where known flaws remain unpatched.
False positives and prioritization. Traditional security tools generate overwhelming numbers of alerts, many of which are false positives. Security teams spend disproportionate time triaging noise rather than addressing real threats.
How Does Google's Agentic AI Approach Work?
Google's CodeMender operates as a managed code security agent that combines AI reasoning with program analysis tools to automate vulnerability remediation.
The documented workflow includes:
- Identify potential security issues. The agent scans code using AI models backed by static and dynamic program analysis tools.
- Analyze code context. It examines surrounding code, dependencies, and data flow to understand whether a finding represents a genuine vulnerability.
- Investigate related components. The agent traces how the vulnerable code interacts with other parts of the system to assess real-world impact.
- Validate exploitability. CodeMender builds and runs proof-of-concept exploits in a customer-managed sandbox to confirm whether a vulnerability is actually exploitable.
- Prioritize findings. The agent uses exploit validation to focus remediation efforts on validated risks rather than theoretical flaws.
- Generate and apply patches. CodeMender creates code fixes that address the root cause, follow the project's style guidelines, and avoid introducing regressions.
- Validate changes. A large language model-based critique tool compares original and modified code to verify that proposed changes do not break functionality.
- Integrate into development workflows. The agent delivers tested fixes through CI/CD pipelines, CLI tools, and IDE integrations like VS Code.
CodeMender demonstrated this capability by upstreaming 72 security fixes to open-source projects, including some containing up to 4.5 million lines of code.
Agentic AI vs Traditional Code Security
Traditional security tools rely on rule-based pattern matching and produce high volumes of alerts. They identify known vulnerability signatures but struggle with complex, context-dependent flaws.
AI assistants can generate code suggestions and answer security questions, but they typically operate in single-turn interactions without maintaining goals across extended tasks.
Agentic AI extends both approaches by combining AI reasoning with program analysis tools, maintaining context across the codebase, and executing multi-step workflows autonomously. Agentic systems can investigate potential vulnerabilities, trace data flows, validate exploitability, and generate tested patches.
No single approach is universally superior. Traditional tools remain valuable for compliance and known-pattern detection. Agentic AI extends capabilities for complex, large-scale environments.
Why Context Matters in AI Code Security
Context determines whether a flagged issue represents a genuine security risk or a benign pattern.
A function that concatenates strings may be safe in one context and vulnerable to injection in another. Understanding context requires analyzing:
- Code relationships: How functions call and depend on each other
- Data flow: Where user input enters and how it propagates through the system
- Application behavior: What the code actually does at runtime
- Attack paths: Whether an attacker could realistically reach and exploit a vulnerable code path
- Business impact: What systems and data the code protects
Agentic AI systems analyze context by combining AI reasoning with program analysis tools including static analysis, dynamic analysis, fuzzing, and SMT solvers. This allows them to identify root causes rather than surface-level symptoms.
Benefits of Agentic AI for Cybersecurity
Documented Benefits
- Automated remediation at scale: CodeMender has successfully patched vulnerabilities across projects with millions of lines of code
- Exploit validation: The system proves whether vulnerabilities are actually exploitable before prioritizing fixes
- Reduced manual workload: Automates repetitive investigation and patch generation tasks
- Real-world deployment: Used across Google's production codebases including Chrome, Android, and Cloud
Potential Benefits
- Faster vulnerability investigation: AI agents can analyze code paths more quickly than manual review
- Broader coverage: Lightweight models like Gemini 3.5 Flash Cyber can be invoked multiple times to scan more code paths
- Improved prioritization: Exploitability validation focuses attention on genuine risks
- Developer productivity: Reduces time spent on security triage and patch writing
Risks and Limitations of Agentic AI Security
Agentic AI for cybersecurity introduces distinct risks that organizations must address.
False positives and negatives. AI models can misjudge code, flagging safe patterns or missing genuine vulnerabilities. Incorrect and incomplete automations in security settings can directly impact production systems.
Unsafe modifications. An AI agent with code modification capabilities could introduce new bugs or security flaws while attempting fixes. CodeMender addresses this through automatic validation and LLM-as-a-judge mechanisms.
Prompt injection and malicious context. If an agent reads external data sources, attackers could inject malicious instructions. OWASP guidance warns that rules files used to steer AI coding tools are "instruction injection surfaces with session-level persistence."
Excessive permissions. Agents granted broad system access could be manipulated to perform harmful actions. Best practices recommend running agents in sandboxed environments with restricted permissions.
Auditability and verification. Many AI models produce actions without traceable reasoning, conflicting with governance frameworks that demand explainability.
Automation bias. As AI assumes more responsibility, human vigilance may erode as analysts accept recommendations without sufficient scrutiny.
Can Agentic AI Replace Cybersecurity Professionals?
No. Agentic AI can automate and assist with many security tasks, but organizations still need human oversight, validation, security policies, and expert judgment.
The reasons are structural:
- Accountability requires human ownership. Security decisions carry legal and organizational responsibility that cannot be delegated to AI systems.
- Context extends beyond code. Business priorities, compliance requirements, and risk tolerance involve human judgment.
- AI systems can fail. Models hallucinate, produce incorrect reasoning, and can be manipulated. Human verification remains essential.
- Governance frameworks require human control. Standards like the NIST AI Risk Management Framework demand traceability and accountability that AI alone cannot provide.
Google's approach reflects this: CodeMender surfaces high-quality patches for human review rather than applying changes without oversight.
How Developers Can Use Agentic AI for Secure Coding
Developers can integrate agentic AI into security workflows through several practical applications:
- Code review assistance: AI agents can analyze pull requests for security issues before human review
- Vulnerability investigation: Agents can trace potential issues through the codebase to assess severity
- Dependency analysis: AI can check for vulnerable or malicious dependencies before they are merged
- CI/CD integration: Security agents can run automatically on commits and block merges when critical issues are found
- Remediation assistance: Agents can generate candidate patches for developer review and testing
- Documentation: AI can explain vulnerabilities and fixes in accessible language
OWASP guidance emphasizes treating AI-generated code as untrusted until verified, and running AI agents in sandboxed environments with restricted permissions.
Can Small Businesses Use Agentic AI for Cybersecurity?
Small businesses can benefit from agentic AI security tools, though the scale differs significantly from Google's environment.
Practical approaches include:
- Using AI-assisted code review tools that integrate with existing development workflows
- Leveraging managed security services that incorporate AI capabilities without requiring in-house expertise
- Adopting CI/CD security scanning with AI-powered static analysis and dependency checking
- Focusing on high-impact controls like dependency scanning, secret detection, and secure coding practices
Google's CodeMender is available through the Gemini Enterprise Agent Platform, making it accessible to organizations beyond Google itself. However, organizations should evaluate whether the scale and cost align with their needs.
The Future of Agentic AI in Cybersecurity
Future possibilities for agentic AI in cybersecurity include:
- Continuous vulnerability analysis: AI agents monitoring codebases in real time
- Automated triage pipelines: AI systems that investigate, validate, and prioritize vulnerabilities without human intervention
- AI-assisted remediation: Agents that generate and test patches for common vulnerability classes
- Secure software supply chains: AI verifying dependencies and detecting tampering
- AI-integrated DevSecOps: Security agents embedded in every stage of development and deployment
These remain possibilities rather than established outcomes. Deployment decisions will depend on reliability, governance, cost, and organizational risk tolerance.
Quick Answers
Q: What is agentic AI in cybersecurity?
Agentic AI in cybersecurity refers to AI systems that perform multi-step security tasks autonomously, using reasoning, tool usage, and context analysis within defined controls.
Q: How does Google use agentic AI for code security?
Google uses CodeMender and Gemini 3.5 Flash Cyber to automatically find, validate, and patch vulnerabilities across its production codebases including Chrome, Android, and Cloud.
Q: Why is securing large codebases difficult?
Massive codebases contain millions of interdependent lines, with vulnerabilities hidden in complex execution paths. AI discovers flaws faster than human teams can fix them.
Q: Can AI automatically detect software vulnerabilities?
Yes. AI systems backed by program analysis tools can identify potential vulnerabilities across large codebases.
Q: Can agentic AI fix security vulnerabilities?
Yes, with human oversight. CodeMender generates validated patches and upstreamed 72 security fixes to open-source projects.
Q: What is the difference between AI and agentic AI?
Generative AI produces content from prompts. Agentic AI adds planning, tool use, multi-step reasoning, and autonomous task execution.
Q: Is agentic AI safe for cybersecurity?
Agentic AI introduces risks including incorrect reasoning, prompt injection, and excessive permissions. Organizations need governance, sandboxing, and human oversight.
Q: Can small businesses use agentic AI for security?
Yes, through managed platforms and AI-assisted tools. Google's CodeMender is available via Gemini Enterprise Agent Platform.
Q: Can agentic AI replace cybersecurity professionals?
No. Human oversight, accountability, and expert judgment remain essential.
Q: What are the risks of AI-powered code security?
Risks include false positives, incorrect fixes, prompt injection, excessive permissions, and automation bias.
Q: What is AI vulnerability detection?
AI vulnerability detection uses machine learning and reasoning to identify security flaws in source code and dependencies.
Q: How does agentic AI improve security workflows?
It automates repetitive investigation, validates exploitability, prioritizes findings, and generates remediation patches.
Q: What is the future of agentic AI cybersecurity?
Possibilities include continuous analysis, automated triage, AI-assisted remediation, and secure software supply chains.
Q: How does AI fit into DevSecOps?
AI agents integrate into CI/CD pipelines to scan commits, analyze dependencies, and generate fixes within development workflows.
Frequently Asked Questions
1. What is agentic AI in cybersecurity?
Agentic AI in cybersecurity refers to AI systems that can autonomously perform multi-step security tasks, including investigation, analysis, tool usage, and remediation assistance. Unlike simple AI assistants, agentic systems maintain goals, reason about complex problems, and execute workflows within defined boundaries.
2. How does Google use agentic AI for code security?
Google developed CodeMender, an AI-powered agent that scans code, validates vulnerabilities through proof-of-concept exploits, and generates tested patches. CodeMender is powered by models including Gemini 3.5 Flash Cyber and has been deployed across Google's production codebases.
3. Why is securing large codebases difficult?
Large codebases contain millions of interdependent lines with vulnerabilities hidden in complex execution paths. The volume and velocity of code changes overwhelm manual security review, and AI now discovers vulnerabilities faster than human teams can remediate them.
4. Can AI automatically detect software vulnerabilities?
Yes. AI systems combined with static and dynamic program analysis can identify potential vulnerabilities across large codebases. CodeMender found 55 confirmed issues in the V8 JavaScript engine, including 10 that other models missed.
5. Can agentic AI fix security vulnerabilities?
Yes, with human oversight. CodeMender generates patches that address root causes, validates them for correctness, and delivers them through development pipelines. The system upstreamed 72 security fixes to open-source projects.
6. What is the difference between AI and agentic AI?
Generative AI produces responses to prompts. Agentic AI extends this with goal orientation, autonomy, tool usage, and multi-step planning, enabling it to complete complex tasks with limited human guidance.
7. Is agentic AI safe for cybersecurity?
Agentic AI introduces risks including incorrect reasoning, prompt injection, unsafe code modifications, and excessive permissions. Organizations should implement sandboxing, least-privilege access, human oversight, and audit trails.
8. Can small businesses use agentic AI for security?
Yes. Managed platforms like Gemini Enterprise Agent Platform make CodeMender accessible. Small businesses can also use AI-assisted code review, dependency scanning, and CI/CD security tools.
9. How can developers use AI for secure coding?
Developers can use AI agents for code review, vulnerability investigation, dependency analysis, CI/CD security scanning, and remediation assistance. OWASP recommends treating AI-generated code as untrusted until verified.
10. Can agentic AI replace cybersecurity professionals?
No. Human oversight, accountability, and expert judgment remain essential. AI systems can fail, hallucinate, or be manipulated, requiring human verification and governance.
11. What are the risks of AI-powered code security?
Risks include false positives and negatives, incorrect patches, prompt injection through malicious context, excessive agent permissions, auditability challenges, and automation bias.
12. What is AI vulnerability detection?
AI vulnerability detection uses machine learning and reasoning combined with program analysis to identify security flaws in source code, dependencies, and application behavior.
13. How does agentic AI improve security workflows?
Agentic AI automates repetitive investigation, validates exploitability before prioritization, generates remediation patches, and integrates into CI/CD pipelines.
14. What is the future of agentic AI cybersecurity?
Possibilities include continuous vulnerability analysis, automated triage, AI-assisted remediation, secure software supply chains, and AI-integrated DevSecOps pipelines.
15. How does AI fit into DevSecOps?
AI agents integrate into development workflows through CI/CD pipelines, IDE plugins, and CLI tools, enabling automated security scanning and remediation within existing processes.
