Google's AI Bug Hunter CodeMender Scans, Confirms, and Fixes Security Flaws

A new AI security agent just landed that does the thing every previous scanner avoided: it writes the patch. Google's CodeMender, in preview now, is the first agent I'd actually wire into a CI pipeline that ships a diff I can read — not an alert I have to triage.

That sounds like a small distinction. It isn't. Every static scanner I've used ends the same way — a flood of findings, a CSV export, a Slack thread, and three engineers who "own" the file quietly closing the tab. The reason is structural: scanners detect, humans patch, and humans are slower than the attackers the scanner is racing against. CodeMender's bet is that the loop closes in the agent.

---

This is an excerpt. Read the full post at otf-kit.dev/blog/google-codemender-ai-bug-hunter — full-stack kits your AI coding agent can actually ship to production. Browse the kits →