Google Cloud adds CodeMender sandbox/human-gate safety controls and extends agent-environment identity and perimeter controls

At its Cloud Security Summit (Nov 5), Google added OS-level sandbox or isolated-VM exploit simulation and human approval gates to CodeMender (still preview), plus a new Model Armor custom topic detector (preview), VPC Service Controls IAM-role ingress/egress rules (GA), Workload Identity Federation for GKE (preview), and Cloud Armor managed rules (preview).

Gives teams precise scoping and safer containment for agentic vulnerability research, and extends identity/perimeter enforcement to the environments where AI agents run (Gemini, GKE, Cloud Run, Agent Compute Engine).

AppSec teams using CodeMender should enable sandbox isolation for exploit validation; Google Cloud platform teams should evaluate Model Armor topic detectors and the new agent identity controls.