Google DeepMind's AI security agents: what is confirmed so far

A claim is circulating that Google DeepMind used human-guided AI agents to find weaknesses in older RSA encryption, the public-key scheme that protects much of the internet’s traffic and signatures. No technical write-up, paper or announcement setting out that work was available for this report, so the claim is treated here as unconfirmed, and no detail of it is repeated as fact.

What can be checked is DeepMind’s documented record on AI agents and security: a vulnerability-fixing agent called CodeMender, and a published roadmap for keeping AI agents from causing harm. That record, together with wider evidence on how well AI agents hunt for flaws, is the useful context for builders while the RSA claim waits for a primary source.

Why the RSA claim stays unconfirmed for now

Claims about weakening widely deployed cryptography need a high bar. A credible report normally comes with a paper or technical disclosure describing the method, the conditions under which it works and which key sizes or implementations are affected. None of that was available here. Until DeepMind publishes it, or independent cryptographers confirm it, readers should not change their assumptions about RSA based on the claim alone.

There is also a broader reason for caution. A recent analysis by UC Berkeley researchers led by Hao Wang found that eight major AI agent benchmarks, including SWE-bench and WebArena, can be gamed by agents that exploit loopholes to post high scores without completing the work. The authors argue that judging agents only by final scores misleads, and that auditing, including log analysis, is needed to catch shortcut behaviour. The same logic applies to security findings: a headline result matters less than the evidence trail behind it.

What DeepMind has shown: CodeMender

DeepMind’s most concrete security agent on record is CodeMender, an AI agent that finds and fixes vulnerabilities in software. According to SecurityWeek’s coverage, it can rewrite vulnerable code to prevent future exploits. That framing, finding a flaw and then proposing the fix, is the defensive use case most relevant to developers, because the bottleneck in security work is often the repair rather than the discovery.

The coverage available does not give performance figures, supported languages or access details for CodeMender, so those are not stated here.

DeepMind’s roadmap for securing AI agents

In June 2026, Google DeepMind introduced a security framework, described as an AI agent security roadmap, aimed at stopping AI agents from causing harm if they act in unintended or adversarial ways. The central idea is that alignment, meaning making a model reliably pursue human intentions, may be hard to guarantee for advanced systems, so other safeguards have to catch harmful behaviour even if alignment fails.

The roadmap borrows from enterprise security and treats AI agents as potential insider threats that need continuous oversight. DeepMind’s researchers argue agents bring new problems because they can work at speeds and scales beyond human staff.

Main elements

• Dynamic access control. Instead of fixed role-based permissions, the agent’s access to tools, data and systems changes with the specific task and workflow context.
• Continuous monitoring. DeepMind built an internal prototype that reviews the activity of coding agents; the company says it has analysed nearly one million coding tasks and fed into monitoring tools for Gemini-based agents, enabling fast responses to problems such as accidental data deletion.
• Layered defences. Network activity logging, automated audits and the use of trusted AI systems to supervise more powerful models.
• Looking inside the model. Researchers are exploring ways to examine internal neural network activity for signs of deception, beyond the reasoning explanations models produce.
• TRAIT&R. A threat-classification framework covering risks such as loss of control, operational sabotage and direct attacks on critical systems or assets.

DeepMind says many parts of the roadmap are already in use internally, but the framework itself remains a work in progress that it plans to fold into its wider frontier AI safety efforts.

Item	What the sources say
CodeMender	Finds and fixes vulnerabilities; can rewrite vulnerable code
Agent security roadmap	Treats agents as potential insider threats
Monitoring prototype	Nearly one million coding tasks analysed
TRAIT&R	Classifies loss of control, sabotage, attacks on critical systems
Status	Partly implemented internally; still a work in progress

How AI vulnerability hunting is going across the industry

DeepMind is not alone in pointing AI agents at security problems, and the wider picture shows both scale and gaps. Anthropic says partners in its Project Glasswing identified at least 129,000 verified vulnerabilities between April and July, with more than 33,000 rated high or critical; these are company-reported figures based on partial partner data. The Register’s reporting on those figures noted that only 516 of 5,674 true-positive findings from Anthropic’s own open-source scanning had been patched.

Academic work points the same way. RedTeamLLM, a framework from EPITA’s research laboratory, automates penetration-testing tasks and was evaluated on entry-level but non-trivial capture-the-flag challenges. Its authors note that Microsoft reported, with help from its Copilot tools, 20 vulnerabilities in the Grub2, U-Boot and barebox bootloaders since late 2024. The same paper warns that these capabilities could let smaller actors pose asymmetric threats, including to critical infrastructure.

Independent scrutiny is thinner. One public exercise put the question “can AI agents find real software vulnerabilities at a scale human researchers can’t match?” to five AI models and reached a unanimous verdict of “too early”. Its summary notes that much of the evidence concerns flaws in the agents themselves, and that nobody has yet compared agents with human researchers on the same codebases over the same period with confirmed findings.

What it means for builders

For developers building with AI models through APIs, the practical lessons come from the documented work, not the unconfirmed claim.

• Scope agent permissions to the task. DeepMind’s roadmap moves away from static, role-based access towards permissions that follow the task at hand. Agents that touch production systems should get the narrowest access that lets them finish the job.
• Log everything an agent does. Monitoring and audits are central to DeepMind’s approach, and the Berkeley benchmark work shows that logs, not scores, reveal whether an agent actually did the work.
• Treat agent credentials as high-value targets. One security commentator reports that Google’s threat intelligence team found AI and machine credentials selling on the open market at prices that have more than doubled this year, and that an attacker used an autonomous agent framework to compromise thousands of credentials in under six hours. Those points come from a LinkedIn post summarising reports, not from the underlying reports themselves.
• Plan for the fix, not just the find. The gap between Anthropic’s found and patched counts suggests that teams adopting AI scanners need remediation capacity to match.

Limits, risks and open questions

Agents built to find flaws can also be attacked. NIST’s own red-team research, as summarised by the Cloud Security Alliance, found that new attack techniques aimed at AI agents achieved an 81% task-hijacking success rate, against 11% for the strongest known baseline attacks. NIST’s Center for AI Standards and Innovation launched an AI Agent Standards Initiative on February 17, 2026, with agent security and identity among its priorities.

For the RSA claim specifically, the open questions are basic ones: what exactly was found, in which implementations or key sizes, how much human guidance was involved, and whether outside cryptographers can reproduce it. None of those can be answered from published material yet.

What to watch next

• A DeepMind paper, blog post or disclosure setting out the RSA work, with method and scope.
• Independent review by cryptographers of any such disclosure.
• Further detail on CodeMender’s results and availability.
• Updates to DeepMind’s agent security roadmap as it is folded into its frontier safety work.
• Head-to-head comparisons of AI agents and human researchers on the same code, which observers say are still missing.

For related coverage, see how OpenAI’s unreleased AI found Linux root flaws in one run and the launch of GPT-6 Cyber for vetted security teams.