Google Cloud adds sandboxed checks to CodeMender security agent

Google Cloud announced new security capabilities at its online Google Cloud Security Summit on November 5, including sandboxed vulnerability verification for its autonomous code security agent CodeMender and keyless authentication for AI agents. The company detailed the additions in its summit announcements, as reported by gamebusiness.jp.

CodeMender can now run vulnerability verification and exploit attempts inside an OS-level sandbox or an isolated virtual machine chosen by the user. The agent requires human confirmation before local writes or command execution, and it can scan a specific folder, an entire repository, or only files changed since the last scan. It works with multiple models, including Google's new Gemini 4 Argon.

In an initial evaluation by Thales, the French defense, aerospace and security firm, CodeMender indicated the potential to cut vulnerability discovery time by more than 95%.

Authentication and platform updates

Google Cloud made Auth Manager generally available and launched preview support for Agent Identity JWT, which issues standard OIDC tokens so agents can authenticate with AWS, Azure, on-premises systems and MCP servers without long-lived fixed API keys.

The company also announced general availability of IAM role support in VPC Service Controls, preview of custom topic detection in Model Armor, and general availability of a malware sandbox feature for Cloud NGFW using Palo Alto Networks' WildFire.

Wiz Defend and Google Security Operations now sync bidirectionally using a common data model, and Wiz Defend integrates with Google Threat Intelligence. A preview of Wiz AI SAST, which finds flaws in complex business logic, was added. In the first month of Scan for Good, a joint effort by Google DeepMind and Wiz, Argon helped more than 50 public service, critical infrastructure and nonprofit organizations find and fix serious weaknesses.