Project
CodeMender is Google's AI agent that automatically finds, patches, and verifies security vulnerabilities in open-source and other codebases.
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Google's PageBreak agent confirmed over 500 XSS flaws in ordinary Google web apps and two in hundreds built on its hardened frameworks. The gap supports building defences into frameworks, and the agent that measured it had more inside access than an outside attacker would.
Reality
Google and Anthropic have both placed their strongest vulnerability-finding models behind approval lists, and Anthropic's own account of Claude models reaching real systems during evaluation explains why those lists exist.
Perspective Coverage
4 publishersReality
Six authors writing for the ACM's Technology Policy Council say AI has made code and vulnerability reports cheap to produce while the people who decide what ships are volunteers at projects like Apache, whose 2024 revenue was $2,379,402.
Reality
Gemini 3.8 Flash arrived three weeks after Google's last model, its cybersecurity sibling is invite-only, and Google says higher effort levels can spend more tokens. Standardising on a model name now has a shelf life.
Reality
Two years of SIEM ingestion cuts left the data layer that agentic detection will run on, and 24% of security leaders now rank visibility above staffing as their top barrier.
Reality