Google Cloud has added isolation and human-approval controls to CodeMender, its autonomous code-security agent. In a blog post dated November 5, 2026, Google Cloud said: "Currently in preview, CodeMender delivers new capabilities for secure isolation and flexible scanning."

Help Net Security reported the same day that Google is putting "new limits on AI agents that hunt threats and fix vulnerabilities," and that "CodeMender remains in preview."

#What is CodeMender?

Google Cloud describes CodeMender as "our autonomous code-security agent" that "helps organizations find and fix code vulnerabilities at machine speed." It says CodeMender "works with multiple models, including Gemini 4 Argon," and claims those models can identify previously unknown vulnerabilities and generate tested patches.

The product has been in preview since July. Google Cloud's July 22, 2026 post said: "CodeMender is our managed code security agent, and starting today, we're bringing its code scanning and remediation capabilities directly to you in preview." On November 5, 2026, Google Cloud said: "Since the CodeMender preview became available in July, hundreds of customers have used CodeMender to help them find and fix vulnerabilities at machine speed."

#How does the sandbox work?

This is the core of the November 5 update. Google Cloud says: "CodeMender isolates vulnerability verification and exploit simulation inside your choice of operating system-level sandbox or isolated virtual machine, and adds human-in-the-loop checks for local write and command execution helping to reduce the risks of malicious exploits and zero-day testing gone awry."

Help Net Security confirmed both parts: "The updates let businesses verify vulnerabilities and simulate exploits in an operating system-level sandbox or an isolated virtual machine." It also reported: "They also add human checks for local writes and command execution to help keep testing within defined limits."

Human approval stays in the loop. Local writes and command execution are subject to Google Cloud's "human-in-the-loop checks." Google Cloud does not spell out whether the check is a hard block before every action or a configurable setting, beyond that sentence. For teams using the preview, the practical point is that CodeMender is not presented as free to write files or run commands on its own.

#What are the three scan modes?

Google Cloud says: "CodeMender now allows you to scan a specific folder, entire repository, or only modified files since the last scan so you have fine grain control on how many files to scan to optimize for scanning speed and costs."

Help Net Security put the same options this way: "Businesses can scan an entire code repository, a specific folder, or only files modified since the last scan, giving them more control over scanning speed and costs."

The three modes:

  1. A specific folder. Narrow the scan to one part of a project.
  2. An entire repository. Cover the full tree.
  3. Only modified files since the last scan. Limit the work to what changed.

#What else shipped in preview?

Google Cloud also announced two related previews in the same post. Each gets a brief note only:

  • Model Armor custom topic detector. "This new enhancement, available in preview, enables you to enforce topic adherence for agents. You can define custom prompt-based rules to identify on-topic and off-topic interactions."
  • Wiz AI SAST. "Now in preview, Wiz AI Static Application Security Testing (SAST) uses agentic reasoning to understand how an application behaves and surface complex business logic flaws."

For Google's other cyber-defense work, see our story on Gemini 4 Carbon going to cyber defenders first. For coding-agent security elsewhere, see the malicious Claude Code extension on Cursor's marketplace.

Our analysis: The useful change for teams already in the CodeMender preview is the combination of isolation and human checks. Exploit simulation stays in a sandbox or VM of the team's choosing, and local writes and commands are not described as fully autonomous. The three scan modes are a cost and speed control, not a security control. All of this remains preview. Google Cloud gives no general-availability date.

#What is unclear?

  • GA and pricing. Neither Google Cloud post gives a general-availability date or a price.
  • How the human checks work. Google Cloud does not describe the UI or whether every local write and command must wait for a person.
  • Product docs. The November 5 post links the July blog, not a separate product documentation page.