Google puts new limits on AI agents that hunt threats and fix vulnerabilities

A credential leak at puts is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

Google Cloud is adding new controls to CodeMender , its AI tool for finding and fixing software vulnerabilities, allowing businesses to isolate attack simulations and target code scans more precisely.

The updates let businesses verify vulnerabilities and simulate exploits in an operating system-level sandbox or an isolated virtual machine.

Our early evaluation of CodeMender shows the potential to reduce vulnerability discovery time by over 95%, while keeping expert validation and remediation under human oversight, said Ivan Fontarensky , CTO Cybersecurity Services, Thales Group.

Google Cloud is extending common security and governance controls across environments where AI agents run, including its Gemini platform, Google Kubernetes Engine (GKE), Cloud Run, and the new Agent Compute Engine.

A new Model Armor custom topic detector, also in preview, lets businesses define prompt-based rules to identify whether agent conversations stay within approved topics.

Anyone connected to puts through the compromised trust relationship is potentially affected, not just puts itself.

Businesses can scan an entire code repository, a specific folder, or only files modified since the last scan, giving them more control over scanning speed and costs.

The controls are designed to help businesses manage agent credentials, protect company data, and detect threats across cloud environments.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

Google and Wiz are combining their security tools to help organizations identify and address risks across code, applications, and multicloud infrastructure.

Wiz discovers and maps autonomous applications, agents, and infrastructure, analyzing applications’ purpose, capabilities, and permissions to uncover hidden risks.

The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.

They also add human checks for local writes and command execution to help keep testing within defined limits.

Auth Manager, now generally available, centralizes credential management in a Google-managed vault governed by IAM, and handles authorization flows and refreshes user-delegated tokens.

puts says the credential has been revoked, and no exploitation has been confirmed so far.

Agent Identity JWT support, available in preview, lets agents authenticate across services including AWS, Azure, on-premises backends, and Model Context Protocol (MCP) servers without relying on static, long-lived API keys.

VPC Service Controls ingress and egress rules now support IAM roles, generally available, and Workload Identity Federation for GKE, available in preview.

If you have any integration or dependency involving puts, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

The network security updates include the generally available Cloud NGFW advanced malware sandbox, powered by Palo Alto Networks WildFire.