What Is Google CodeMender and Gemini 2.5 Computer Use?

TL;DR

Google DeepMind's CodeMender autonomously found and upstreamed 72 verified security fixes to open-source projects in six months, some with up to 4.5 million lines of code. Alongside it, Gemini 2.5 Computer Use operates browsers and apps like a human, clicking, typing, and navigating to complete multi-step digital tasks on its own.

Transcript

Google DeepMind just revealed an AI called Code Mender that's already finding and fixing security flaws across massive open-source projects completely on its own. They've also stepped into a field that's been heating up fast. AI that can actually use a computer. Their new model can click, type, and navigate the web like a person. It's Google's bigg... Read More

Key Insights

• CodeMender is an autonomous AI code developer for open-source security that has upstreamed 72 verified security fixes in six months, working on projects with up to millions of lines of code before any human reviews the patch.
• CodeMender understands code logic rather than just scanning: it identifies the root cause of a vulnerability, generates a patch, validates it, and checks for regressions automatically before sending it to human maintainers.
• The CodeMender agent runs on Google's Gemini Deep Think models, a version of Gemini fine-tuned for reasoning about code that can debug, patch, and rewrite large sections while keeping consistent style and functionality.
• CodeMender used fbounds-safety compiler annotations on the libwebp library, forcing bounds checks that block buffer overflows; DeepMind says the 2023 iOS zero-day exploit likely would not have happened with these in place.
• CodeMender combines static analysis, dynamic analysis, fuzzing, differential testing, and SMT solvers, plus a multi-agent system with sub-agents like a code critique agent that compares original and modified code line by line.
• Gemini 2.5 Computer Use operates software like a person through browsers and mobile interfaces, built on Gemini 2.5 Pro's visual reasoning and available now via the Gemini API in Google AI Studio and Vertex AI.
• Gemini 2.5 Computer Use works in a loop: each step begins with a screenshot, recent actions, and the request, then outputs a function call like click, type, or scroll until the goal is reached or a safety check stops it.
• Gemini 2.5 Computer Use hit state-of-the-art results on Online Mind2Web, WebVoyager, and Android World, with browserbase reporting over 70% accuracy and roughly 225 seconds average latency per full task.

Questions & Answers

Q: What is Google DeepMind's CodeMender?

CodeMender is an AI code developer for open-source security that autonomously finds and fixes security flaws. Instead of just scanning for vulnerabilities like older tools, it understands the logic of the code, identifies the root cause, generates a patch, and validates it automatically to make sure nothing breaks. It has already upstreamed 72 verified security fixes to open-source projects in just six months, including projects with up to millions of lines of code, all before a human even reviews the patch.

Q: How many security fixes has CodeMender made and to what kind of projects?

CodeMender has upstreamed 72 verified security fixes to open-source projects in just six months. These are not minor changes; the projects involved contain up to millions of lines of code, with the video citing figures in the multi-million range. After CodeMender generates and validates a patch and checks for regressions, the fix is sent to human maintainers for review before being merged, so its output feeds directly into real, large-scale open-source software.

Q: How does CodeMender fix code under the hood?

CodeMender combines static analysis, dynamic analysis, fuzzing, differential testing, and SMT solvers, an arsenal of advanced program analysis tools that reveal how data flows and where weaknesses hide. It uses a multi-agent system with sub-agents specializing in debugging tasks, including a code critique agent that compares original and modified code line by line. If it spots something off, it triggers automatic self-correction. When it hits a bug, it opens the debugger, inspects the call stack, and reasons step by step to find the true cause.

Q: What is Gemini 2.5 Computer Use?

Gemini 2.5 Computer Use is a specialized version of Gemini 2.5 that can operate software the same way a person would, through a browser or mobile interface. Built on Gemini 2.5 Pro's visual reasoning capabilities, it powers agents that can see and interact with user interfaces, doing tasks like filling forms, clicking menus, and dragging and dropping files autonomously. It is available through the Gemini API inside Google AI Studio and Vertex AI, where developers can integrate it into their own systems.

Q: How does the Gemini 2.5 Computer Use model actually work?

The model works in a loop. Each step starts with a screenshot of the interface, a record of recent actions, and the user's request. The model analyzes everything and outputs a function call like click, type, or scroll. The action is then executed, a new screenshot is taken, and the process repeats. This continues until the goal is reached, an error happens, or the system stops due to a safety check or user decision. It is primarily optimized for web browsers but shows promise for mobile UI control.

Q: How well does Gemini 2.5 Computer Use perform on benchmarks?

On benchmarks, Gemini 2.5 Computer Use performed at state-of-the-art levels, beating other models on Online Mind2Web, WebVoyager, and Android World. According to browserbase's independent evaluation, it achieved the best balance between accuracy and latency, with over 70% accuracy and an average latency around 225 seconds per full task. This makes it faster and more reliable than competing systems like OpenAI's computer-using agent, though it still struggles with multi-step or language-specific tasks like summarizing or translating.

Q: What safety measures did DeepMind build into Gemini 2.5 Computer Use?

DeepMind integrated safety guardrails directly into the model. A per-step safety service checks every proposed action before execution to ensure it is not doing anything risky like bypassing captchas, compromising system integrity, or controlling sensitive devices. Developers can enforce custom rules requiring user confirmation before high-stakes actions like purchases or critical system changes. DeepMind also published a detailed system card explaining how it mitigates risks such as intentional misuse, unexpected behavior, and prompt injections, and urges thorough testing before autonomous deployment.

Q: How is Google already using Gemini 2.5 Computer Use internally?

Google has deployed the model internally for UI testing, which can speed up software development drastically. Teams use it in products like Project Mariner, the Firebase testing agent, and AI mode in search, where it automatically recovers broken workflows by assessing the screen and deciding what to do next. External testers reported strong results: Poke.com found it about 50% faster and more reliable, Autotab reported an 18% improvement on complex tasks, and Google's payments team said it rehabilitates 60% of broken end-to-end UI tests.

Summary & Key Takeaways

• Google DeepMind revealed CodeMender, an autonomous AI that finds and fixes security flaws in open-source projects on its own. It has upstreamed 72 verified fixes in six months across codebases with up to millions of lines, understanding code logic, finding root causes, patching, and validating before human review.

• CodeMender runs on Gemini Deep Think and uses static and dynamic analysis, fuzzing, differential testing, and SMT solvers, plus specialized sub-agents. It proactively rewrites code to be safer, adds fbounds-safety annotations, and uses an LLM judge to confirm patched functions behave the same as before merging.

• Gemini 2.5 Computer Use lets AI operate browsers and apps by interpreting screenshots and issuing actions like click, type, and scroll. It reached state-of-the-art benchmark scores, is deployed internally for UI testing and workflow recovery, and includes per-step safety checks against risky actions and prompt injection.