Modern software supply chains generate security alerts faster than engineering teams can triage them. Static analysis tools and dependency scanners uncover thousands of vulnerabilities, but remediation remains painfully manual. Simple LLM code generators often fall short: they lack repository context, hallucinate non-existent APIs, and fail to verify whether fixes break adjacent unit tests.

In this practical, code-first session, we explore CodeMender, an agentic remediation system designed to diagnose, rewrite, and verify code at repository scale. We examine how CodeMender decomposes vulnerability repair into an iterative loop: parsing abstract syntax trees (ASTs), formulating semantic patches with Gemini, and deterministically validating fixes using isolated runtimes on Google Cloud. Attendees will discover how to transition from passive alerts to an autonomous remediation pipeline that submits verified, compilable pull requests directly into their CI/CD lifecycle.

Key Takeaways
Deconstructing CodeMender: how agentic code-repair loops analyse, patch, and verify repository vulnerabilities.
Mitigating regression risks through automated test execution and semantic diff validation.
Running sandboxed remediation environments using Cloud Build and Cloud Run.
Integrating autonomous remediation agents into existing enterprise CI/CD and workflows.