Google Cloud Adds Security Controls for AI Agents

Google Cloud detailed new security controls in a company blog post for building, running and monitoring AI agents. The updates cover code remediation, agent identity, network boundaries, content rules and threat detection.

CodeMender, currently in preview, can verify vulnerabilities and simulate exploits inside an operating system sandbox or isolated virtual machine. It also adds human approval for local write operations and command execution. Users can scan a folder, a full repository or files modified since the previous scan.

Auth Manager is now generally available and stores agent credentials in a Google managed vault governed by identity and access management policies. Agent Identity JWT support is in preview, allowing agents to use standard OIDC tokens across AWS, Azure, local systems and MCP servers without static API keys. New identity based VPC Service Controls and a Model Armor topic detector provide additional network and conversation restrictions.

Google Cloud also expanded its integration with Wiz. Wiz AI SAST is in preview for finding application logic flaws, while Wiz Defend and Google Security Operations now share data and support bidirectional synchronization. Google says a separate Scan for Good program used its Argon model to help more than 50 public service and critical infrastructure organizations identify and fix critical exposures during its first month.