AI Bug Hunters Start Writing Their Own Fixes

AI bug hunters move from finding problems to fixing them

AI bug hunting systems are security automation tools that combine code vulnerability scanning, exploit confirmation, and automated patch generation so that developers can review AI-suggested fixes instead of manually searching for every flaw across large, fast-changing codebases. Today’s shift in software security is not that AI helps with bug triage; it is that AI agents are starting to own the entire loop from detection to remediation. Google’s new CodeMender preview scans repositories for security flaws, confirms they are exploitable, then generates patches for developer review. Microsoft and Wiz are going further, proving that multi-model AI bug detection can outperform single systems on real-world benchmarks. The net result is a redefined developer workflow: human engineers concentrate on validation and design choices while AI agents grind through the repetitive, error-prone work of finding and fixing vulnerabilities at scale.

CodeMender: from static scanning to self-healing code

Google’s CodeMender is opinionated about how security should work: scanning alone is not enough if defenders want to keep up with attackers already using AI to speed up their work. Instead of stopping at pattern matches, CodeMender first performs deep code vulnerability scanning across languages including C/C++, Go, Java, Python, Ruby, Rust and TypeScript, targeting memory corruption, injection flaws, web issues, cryptographic weaknesses, and insecure data handling. Then it tries to break the application on purpose, building a proof-of-concept exploit and running it in a customer-controlled sandbox to cut back false positives. Once a flaw is confirmed, the agent writes a patch, runs it past a separate model acting as judge to catch regressions, and ships it as a code diff for manual approval. Google describes this as a step toward a “continuous, self-healing agentic software development lifecycle” where code is secured and patched before it hits production.

Atlas and MDASH: multi-model AI bug detection goes over 90%

While CodeMender focuses on workflow, Wiz’s Atlas and Microsoft’s MDASH are making a more aggressive claim: the right mix of models can catch more than 90 percent of real bugs in benchmark tests. Atlas, used internally by Wiz, routes each stage of security investigation—threat modeling, hunting, validation, proof generation—to whichever model scores best for that task, pairing Claude Opus 4.6 with GPT-5.5 for vulnerability analysis. It achieved a 90.9 percent success rate on CyberGym and uncovered more than 200 zero-day issues in widely used open-source code. Microsoft’s MDASH combines MAI-Cyber-1-Flash, based on the MAI-Thinking-1 reasoning model, with GPT-5.4 in a red-team/green-team harness. MAI-Cyber-1-Flash is designed to handle up to 90 percent of tasks, with MDASH detecting, patching, and validating vulnerabilities before handing the toughest 10 percent to GPT-5.4. In benchmark terms, MDASH scored 95.95 percent on CyberGym, beating Mythos, Gemini and GPT competitors.

From one-off scans to continuous, economical security automation

The most important change is not raw accuracy scores; it is the move from one-off deep scans to continuous, economical security automation. Wiz’s researchers argue that pointing a single frontier model at a codebase once is a bad strategy: scans are expensive, code changes constantly, and point-in-time analysis cannot cover every repository. Their bet with Atlas is an architecture that can swap in better models over time, using frontier depth only where expert reasoning is needed and always attaching evidence to each finding rather than a plausible AI answer. Microsoft takes a similar line with MDASH, where a smaller in-house model handles most tasks and only escalates complex cases to a larger system, cutting customer costs while maintaining performance. Google, meanwhile, positions CodeMender inside its Gemini Enterprise Agent Platform and AI Threat Defense offerings, with enterprise-grade governance, secure traffic routing, data isolation, encryption and zero source-code retention baked in as guardrails.

What this means for developers and security teams

If AI systems can detect and patch most vulnerabilities automatically, developers’ jobs change in a way that many teams will welcome. With CodeMender, no fix reaches a repository without a human reviewing the diff and approving it. That shifts engineers from manual bug hunting toward code review and validation, judging whether automated patches align with architectural intent rather than spending hours chasing SQL injection in forgotten endpoints. In MDASH, green-team agents already remediate issues once red-team agents find and simulate attack paths. Atlas routes tasks to whichever model is best at that piece of the work. Together, these approaches reduce the workload on security specialists and speed up vulnerability remediation. Google openly frames this as a move from passive scanning to automated code remediation that cuts zero-day risk. Microsoft and Wiz are betting that multi-model AI will become the default way to keep code continuously secured as new models and new threats arrive.