Four in ten companies add flaws faster than they fix them. Google's CodeMender bets on fixes with a human gate
Google's security update adds sandboxed autonomous remediation in CodeMender, OIDC tokens for agents and topic rules in Model Armor. The bottleneck it targets is the fix queue, not detection.
Listen to this article · 4 min
AI-generated narration of the full article.
The number in Google’s security announcement that deserves the most attention is not Google’s. It comes from IDC’s Katie Norton, quoted in the post: nearly 40% of enterprises add vulnerabilities faster than they can remediate them.
If that is your situation, a better scanner makes it worse. Every new finding lands in a queue that was already growing. The products Google announced at its Cloud Security Summit on November 4 are interesting mostly as attempts to drain that queue.
Fixing, not finding
CodeMender, Google’s autonomous code-security agent, has been in preview since July, and Google says hundreds of customers have used it. The update adds autonomous remediation that runs inside an OS-level sandbox or an isolated VM, with human-in-the-loop checks before a fix is accepted. It can scan a specific folder, a whole repository or only the files changed since the last scan, and it works with several models, including Gemini 4 Argon.
Thales, which evaluated it early, says CodeMender could cut vulnerability discovery time by more than 95%. That is a customer’s early estimate about discovery, quoted by Google, not a measured result on remediation.
The design choices are the right ones. A fix generated in a sandbox can be built and tested before anyone sees it, and the human reviews a working patch instead of a finding. That is where automation helps most: it turns a reviewer’s job from writing a fix into judging one.
It also moves the bottleneck, as we argued in our piece on verification capacity. If CodeMender produces fifty patches a day, someone still has to approve fifty patches a day. Teams that already struggle to review human pull requests should decide in advance which classes of fix can merge with lighter review: dependency bumps with passing tests, for example, but not changes to authentication code.
Agents get tokens instead of keys
The identity changes are quieter and may matter more in a year.
Agent Identity’s Auth Manager is now generally available. It runs OAuth 2.0 and PKCE flows for agents and refreshes the tokens users delegate to them. A preview adds JWT support: agents receive standard OIDC tokens and can authenticate to AWS, Azure, on-premises systems and MCP servers without static, long-lived API keys.
Static keys are how most agents reach other systems today, and a leaked key works until someone notices. Short-lived, verifiable tokens are the same improvement IBM made with expiring agent credentials, now offered across clouds. Identity-based VPC Service Controls also accept IAM roles (generally available) and Workload Identity Federation for GKE (preview), so network perimeters can follow the agent’s identity rather than its address.
Topic rules for regulated chat
Model Armor adds a custom topic detector in preview: prompt-based rules that keep an assistant on or off defined topics. Google aims it at healthcare, insurance and retail. It is useful for keeping a claims assistant from giving medical advice. It is not an authorization control; a model that stays on topic can still act on the wrong record.
What to do with it
Measure the queue before adding tools. If findings already outnumber fixes, prioritize remediation automation with sandboxed testing over new detection. Replace static agent keys with short-lived tokens wherever the target system accepts OIDC. And treat topic filters as content policy, kept separate from the permission checks that decide what an agent may change.