Helping you build and defend at machine-speed in the agentic era

Google Cloud highlights the risks of ungoverned autonomous systems in software development, noting that human review cannot match machine-speed commits and unvetted dependencies, which may introduce vulnerabilities or backdoors. To address this, the company introduces CodeMender, an autonomous code-security agent that identifies and fixes vulnerabilities in real time, including previously unknown flaws, and generates tested patches before exploitation occurs. CodeMender supports multiple models, including Gemini 4 Argon, and has already been used by hundreds of customers since its preview in July to reduce vulnerability discovery time by over 95%.

The announcement also introduces Auth Manager, now generally available, which centralizes credential management in a Google-managed vault governed by IAM, automating OAuth 2.0/PKCE flows to minimize consent fatigue and credential theft. Agent Identity JWT support, in preview, enables agents to authenticate securely across AWS, Azure, on-premises backends, and MCP servers using standard OIDC tokens, eliminating the need for static, long-lived API keys.

Google Cloud expands perimeter defenses with identity-based VPC Service Controls, generally available, and Workload Identity Federation for GKE, in preview, allowing security teams to enforce granular, identity-based boundaries across enterprise clusters without manual exceptions. A new Model Armor custom topic detector, available in preview, enforces topic adherence for agents, tailored for industry use cases in healthcare, insurance, and retail to maintain compliance and security in agent conversations.

To counter advanced network threats, Google Cloud introduces Cloud NGFW advanced malware sandbox, generally available, enabled by Palo Alto Networks WildFire, alongside streamlined firewall operations and automated exploit protection with Cloud Armor managed rules, backed by Thales Imperva’s global threat intelligence scanning 1.5 trillion monthly web requests. These tools aim to neutralize autonomous, multi-agent threats by empowering defenders with intelligence-driven operations and real-time threat detection.