Google DeepMind's CodeMender agent upstreamed 72 security fixes to open-source projects

CodeMender finds and fixes security flaws in code. In its first six months, DeepMind used it to send 72 security fixes to open-source projects, some with millions of lines of code. Humans review every patch.

Organization: Google DeepMind
Industry: Security Research
When: Oct 2025
Evidence: Company reported
Agents and tools: CodeMender Gemini Deep Think

Reported outcome

72 security fixes upstreamed to open-source projects in six months, including projects as large as 4.5 million lines of code.

72
Fixes upstreamed
4.5M lines
Largest codebase

Caveats

Stated by the company that uses the agent (blog, earnings call, interview). Not independently audited.

CodeMender is a research project, not a product you can use.
Human researchers review every patch before it is submitted. The count is of accepted human-reviewed patches, not fully autonomous work.

What the agent does

CodeMender looks for the root cause of a vulnerability, writes a patch, and checks it. It uses static analysis, fuzzing, differential testing, and SMT solvers. A separate critique step checks that the patch is correct and causes no regressions. It can also harden code before a bug is found, for example by adding bounds-safety annotations to libwebp.

Why this works

Fixing a bug is easier to verify than finding one. If the tests pass, the crash is gone, and a reviewer agrees, the patch is good. The critique step catches bad patches before a human spends time on them.

What to copy

Add a "critic" step that must approve every change before a human sees it.
Feed the agent real tool output (sanitizers, fuzzers, test results), not just code.
Keep human review for anything you send to another project.

Starter prompt

Written by us. Use only on code you own or maintain.

Crash report: {sanitizer_output}
Relevant code: {files}

1. Explain the root cause in 2 sentences. Do not just guard the symptom.
2. Write the smallest patch that fixes the root cause.
3. Write a regression test that fails before and passes after.
4. Review your own patch as a security reviewer. List any way it could
   break existing behavior.