BleepingComputer

Hacker News

Sarah Drasner

Google patched 1,072 security bugs across Chrome 149 and 150, its two June releases. That’s more than the 1,036 fixes across the previous 23 versions released over roughly two years.
The company credits AI tooling for the jump. Chrome now uses large language models throughout the entire vulnerability lifecycle: finding bugs, triaging reports, rating severity, generating patches, and running tests. Two systems do most of the heavy lifting. The first is a Gemini-powered agent harness that automates triage and is reportedly saving hundreds of developer hours per month. The second is Big Sleep, built with DeepMind and Project Zero, which recently dug up a 13-year-old sandbox escape vulnerability. In May alone, the systems blocked more than 20 vulnerabilities from reaching production.
Chrome’s director of engineering said LLMs have “fundamentally shifted the economics of cybersecurity.” That’s a bold claim, but the numbers are hard to argue with.
Microsoft reported something similar: a record 570 flaws patched in its July Patch Tuesday, also citing AI. Apple, by contrast, shows no comparable acceleration.
There’s a less comfortable side to this. As Chrome’s Sarah Drasner noted when the accompanying research paper dropped, open source software is getting hammered by AI-assisted bug hunting — from security researchers, bounty hunters, and attackers alike. More bugs found faster is good. More attack surface being probed faster is the other side of that coin.
Google is also trying to close the gap between when a fix is ready and when it actually reaches users. The plan includes moving to a two-week release cycle with weekly security updates, piloting twice-weekly security releases, and developing dynamic patching so Chrome can apply updates without a full browser restart.

Collections

Google patched 1,072 security bugs in Chrome 149 and 150 — more than the previous 23 versions combined — crediting AI tooling for the dramatic increase. The pipeline uses Gemini-powered agents for fuzzing and vulnerability analysis, plus Big Sleep (developed with DeepMind and Project Zero), which uncovered a 13-year-old sandbox escape bug. Automated triage is saving hundreds of developer hours monthly and blocked over 20 vulnerabilities from reaching production in May alone. Google is also accelerating delivery with two-week release cycles, weekly security updates, and dynamic patching without browser restarts. Microsoft reported a similar AI-driven surge in its July Patch Tuesday. The trend raises questions about whether attackers are using the same AI tools to find vulnerabilities before defenders do.

Google fixed more Chrome security bugs in two releases than the previous two years, crediting AI tools