CodeMender 解析：Google Gemini AI 資安代理自動修漏洞全解讀 | CodeMender: Google's AI That Auto-Patches Security Bugs

7月 22, 2026

By Kit 小克 | AI Tool Observer | 2026-07-23

🇹🇼 CodeMender 解析：Google Gemini AI 資安代理自動修漏洞全解讀

CodeMender 是 Google DeepMind 打造的 AI 資安代理，最新推出的核心模型 Gemini 3.5 Flash Cyber 專門用來自動找漏洞、驗證漏洞、修補程式碼。這不是概念展示——DeepMind 說 CodeMender 過去半年已經在真實開源專案裡送出 72 個安全修補，其中有專案程式碼量高達 450 萬行。如果你在意軟體供應鏈安全，這是這幾天最值得搞懂的 AI 資安新聞。

CodeMender 到底在做什麼？

CodeMender 分兩種模式運作：被動修補（收到已知漏洞回報後自動生成修復程式碼）與主動重構（在漏洞被利用前，直接改寫程式碼消除整個漏洞類型，例如把容易寫錯的記憶體操作換成安全寫法）。修補產出後不會直接上線，而是先送給人類資安工程師審查再決定要不要合併。

Gemini 3.5 Flash Cyber 抓漏洞的實測數字

DeepMind 拿高複雜度的 V8 JavaScript 引擎做測試，固定呼叫次數下比較不同模型：

Gemini 3.5 Flash Cyber：找到 55 個獨立確認漏洞
一般版 Gemini 3.5 Flash：47 個
Anthropic Opus 4.6：36 個
其中 10 個漏洞是其他模型完全沒抓到的

支援語言涵蓋 C、C++、Go、Java、Python、Ruby、Rust、TypeScript/JavaScript，框架則涵蓋 Django、Flask、React、Spring Boot、Express 等主流企業框架。

誰現在能用？現實限制先講清楚

老實說，一般開發者現在還碰不到。Gemini 3.5 Flash Cyber 目前只透過 CodeMender 開放給政府單位與受信任合作夥伴，屬於限量試點（pilot）階段；企業用戶要用的話得走 Google Gemini Enterprise Agent Platform 和 AI Threat Defense 這條路。換句話說，這是資安團隊的工具，不是給個人開發者掃自己 repo 用的免費玩具。

對開發者與資安團隊的實際意義

AI 自動抓漏洞、自動修補聽起來很誘人，但別急著把 code review 流程外包給它。CodeMender 的定位很清楚：加速人類資安工程師的工作量，不是取代審查。72 個修補聽起來多，但攤在半年、多個開源專案上，其實還是謹慎、逐一人工確認的節奏。真正的價值在於它能在大型程式碼庫（450 萬行等級）裡找到人類容易漏掉的漏洞類型，而不是「按一鍵全自動修好」。

好不好用，試了才知道。

🇺🇸 CodeMender: Google's AI That Auto-Patches Security Bugs

CodeMender is Google DeepMind's AI security agent, and its newest engine, Gemini 3.5 Flash Cyber, is built specifically to discover, validate, and patch software vulnerabilities automatically. This isn't a lab demo — DeepMind says CodeMender has already shipped 72 security patches across real open-source projects over the past six months, including codebases as large as 4.5 million lines. If you care about software supply chain security, this is the AI security story worth understanding this week.

What CodeMender Actually Does

CodeMender operates in two modes: reactive patching (auto-generating a fix once a known vulnerability is reported) and proactive rewriting (rewriting code ahead of time to eliminate entire classes of vulnerabilities, like replacing unsafe memory operations with safer patterns). Every patch goes through human security engineer review before merging — nothing ships automatically.

How Good Is Gemini 3.5 Flash Cyber, By The Numbers

DeepMind benchmarked it against the notoriously complex V8 JavaScript engine, with a fixed number of model invocations:

Gemini 3.5 Flash Cyber: 55 unique confirmed vulnerabilities found
Standard Gemini 3.5 Flash: 47
Anthropic's Opus 4.6: 36
10 of those bugs were caught by no other model

Supported languages include C, C++, Go, Java, Python, Ruby, Rust, and TypeScript/JavaScript, across enterprise frameworks like Django, Flask, React, Spring Boot, and Express.

Who Can Actually Use It Right Now

Here's the honest limitation: individual developers can't touch this yet. Gemini 3.5 Flash Cyber is only available through CodeMender to governments and trusted partners as part of a limited-access pilot. Enterprise access runs through Google's Gemini Enterprise Agent Platform and AI Threat Defense. This is a security-team tool, not a free scanner for your side-project repo.

What This Means for Developers and Security Teams

An AI that finds and patches vulnerabilities automatically sounds great, but don't hand your code review process over to it just yet. CodeMender's actual role is clear: it accelerates human security engineers, it doesn't replace them. 72 patches across six months and multiple projects is a deliberate, carefully-reviewed pace, not mass automation. The real value is catching vulnerability classes humans tend to miss inside massive codebases (think 4.5M-line scale) — not a one-click "fix everything" button.

好不好用，試了才知道 — the only way to know if a tool's good is to actually try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士