Google Adds Credential‑Management and Sandbox Controls to CodeMender AI Agent

Qué ocurrió

Google Cloud released a suite of security controls for CodeMender, its AI‑driven vulnerability discovery and remediation service. Customers can now run exploit simulations inside OS‑level sandboxes or isolated virtual machines, enforce human‑review checkpoints for local writes and command execution, and limit scans to specific code scopes. Across the broader AI stack, Google introduced Auth Manager—a vault‑backed credential store governed by IAM—JWT‑based agent identities for cross‑cloud federation, IAM‑driven VPC Service Controls, and a Model Armor prompt‑filtering detector. Network protections were expanded with Cloud NGFW (Palo Alto WildFire) and Cloud Armor managed rules that ingest Thales Imperva threat intel. The features are in preview or generally available and aim to contain autonomous, multi‑agent threats.

Por qué es importante para la confianza y el cumplimiento

• These controls satisfy the access‑control objective of ensuring AI agents operate with least‑privilege identities, sandboxed execution, and human oversight, providing defensible evidence for audit frameworks.
• Implement vault‑based secret management and IAM policies to demonstrate control over AI‑agent credentials.
• Collect sandbox execution logs and human‑approval records as audit evidence for access‑control compliance.

Who is affected

Recommended actions

1. Define and enforce a credential‑lifecycle policy for AI agents using a vault and IAM roles.
2. Enable sandboxed exploit simulation and require manual sign‑off for any file‑system or command actions.