Google Cloud adds new controls to keep AI agents and agent-written code safe
Google Cloud shared new security tools for companies that use AI agents at its Security Summit on November 4. The updates cover code that agents write and the agents that run in production.
CodeMender, Google's agent that finds and fixes code vulnerabilities, is in preview. It now tests fixes inside a sandbox or an isolated virtual machine, and asks a person before it writes files or runs commands on a local machine. Teams can scan one folder, a whole repository or only the files changed since the last scan. Google says hundreds of customers have used it since July.
For agents in production, Auth Manager is now generally available. It keeps agent credentials in a Google-managed vault and refreshes the tokens that let an agent act for a user, so people see fewer consent prompts. A new preview option lets agents sign in to AWS, Azure and MCP servers without long-lived API keys. A Model Armor preview lets admins write their own rules to keep an agent on topic.
What it means for your work
- For developers: Try CodeMender's changed-files scan so security checks keep pace with AI-written code.
- For IT admins: Move agent keys into Auth Manager instead of storing them in code or config files.
- For teams building customer agents: Use a topic rule to stop an agent from drifting into subjects it should not handle.
For security controls on another AI tool, see our report on the Claude Enterprise security center.