Google fixed more Chrome bugs in June than over the past two years, thanks to AI
Points and comments are a snapshot, not live.
Google used AI agents to find and fix over 1,000 Chrome security bugs in mid-2026.
Google detailed how LLMs scaled vulnerability discovery, triage, and patching across Chrome. An AI agent found a sandbox escape bug that had survived 13 years. In Chrome 149 and 150, 1,072 security bugs were fixed, surpassing the total fixed across the prior 23 milestones combined. Automated triage phases filter noise, reproduce bugs, add metadata, and assign owners. A fixing-critic agent loop generates candidate patches. Google is also investing in memory safety: expanding MiraclePtr, spanification, and Rust adoption. It pilots two security releases per week and dynamic patching to reduce the patch gap.
What commenters are saying
Commenters split between those who see genuine security value in AI-driven bug hunting and those skeptical of the blog's one-sided success narrative. Several questioned what the article omitted: false-positive rates, reverted fixes, and bugs introduced by AI patches. Some noted that the surge in fixes could partly reflect easier backlog bugs rather than truly critical vulnerabilities. Others argued that even introducing some new bugs is a net win given the growing exploit-chain complexity in browsers. A few pointed out that internal Google models likely outperform public Gemini.