Google Cloud moved CodeMender, its AI agent for finding and fixing software vulnerabilities, from a research-only preview into a broader enterprise preview on July 22, 2026, making it available to Google Cloud and Gemini Enterprise customers rather than just internal and hand-picked external testers. CodeMender was first introduced by Google DeepMind in October 2025 as an experimental research project; this release is the productization step, wrapping the same core capability into a managed offering security teams can actually deploy: an agent that scans a codebase, identifies a vulnerability, writes an exploit to prove the flaw is real, then generates and validates a patch. It supports several mainstream languages including C/C++, Go, Java, Python, Ruby, Rust, and TypeScript, and the validation step matters, since rather than pattern-matching against known bad code shapes the way static analyzers do, CodeMender runs the proposed exploit and the proposed fix in an isolated, customer-managed sandbox to confirm the patch actually closes the hole without breaking existing behavior, which is the step that has historically made AI-generated security patches too risky to trust unsupervised. For engineering and security teams, the pitch is closing the gap between vulnerability discovery and remediation, which in most organizations is measured in weeks or months because patching competes with feature work for engineer time. Tools like this shift that bottleneck from human patch-writing capacity to review-and-approval capacity, which is a different problem but arguably a more tractable one. It also continues a pattern of the large AI labs treating application security as a wedge for enterprise AI agent adoption, since Anthropic, OpenAI and Google have all shipped some version of an AI-assisted vulnerability or code-review agent in the past year, which means engineering leaders evaluating one of these tools will increasingly be choosing a vendor and workflow, not just a feature.