VULNpocalypse
InformationalEcosystem changeMonitoring

Google Cloud adds AI agent security controls, Help Net Security reports

Help Net Security reports new Google Cloud controls for CodeMender and AI agents; review which features are preview before relying on them.

Published
Exploitation
No, the source describes a product update and reports no vulnerability or exploitation

What happened

According to Help Net Security, Google Cloud is adding new controls to CodeMender, its AI tool for finding and fixing software vulnerabilities. This is a product announcement, not a vulnerability disclosure. The report does not describe any flaw, incident or exploitation.

Help Net Security reports these changes to CodeMender:

  • Vulnerabilities can be verified and exploits simulated in an operating system-level sandbox or an isolated virtual machine.
  • Human checks are added for local writes and command execution.
  • Scans can cover a whole repository, a specific folder, or only files changed since the last scan.
  • CodeMender remains in preview.

The outlet also reports broader controls for environments where AI agents run, including Gemini, GKE, Cloud Run and the new Agent Compute Engine:

  • Auth Manager, generally available. It centralizes credential management in a Google-managed vault governed by IAM and refreshes user-delegated tokens.
  • Agent Identity JWT support, in preview. It lets agents authenticate to AWS, Azure, on-premises backends and MCP servers without static, long-lived API keys.
  • VPC Service Controls ingress and egress rules with IAM roles, generally available.
  • Workload Identity Federation for GKE in VPC Service Controls, in preview.
  • A Model Armor custom topic detector, in preview.
  • The Cloud NGFW advanced malware sandbox, generally available and powered by Palo Alto Networks WildFire.
  • Cloud NGFW project-level resources, generally available.
  • Cloud Armor managed rules, in preview, using Thales Imperva threat intelligence.

The report also covers wider work with Wiz. This includes Wiz AI SAST, in preview, and a shared data model between Wiz Defend and Google Security Operations, as reported by Help Net Security.

Am I affected?

No vulnerability is reported, so there is nothing to patch.

This update is relevant if you use CodeMender or run AI agents on Google Cloud services named in the report. Pricing, regional availability and rollout dates are not confirmed in the source.

What to do now

  1. If you test CodeMender, note that Help Net Security says it remains in preview. Check that its use fits your policy for preview tools.
  2. If you use CodeMender for exploit simulation, review the newly reported sandbox, isolated VM and human-check options. These help keep testing within defined limits, according to Help Net Security.
  3. If your agents rely on static, long-lived API keys, evaluate whether Auth Manager (generally available) or Agent Identity JWT (preview) fits your environment.
  4. Confirm availability and configuration details in Google Cloud’s own documentation. This advisory is based on a single news report.

Sources