Google says AI helped Chrome fix over 1,000 security bugs in two releases

Google said AI tooling had helped Chrome’s security team fix 1,072 vulnerabilities across two releases, Chrome 149 and 150 — more than the total fixed across the previous 23 milestones combined. The company said large language models were used throughout the vulnerability lifecycle: discovering flaws, reproducing bug reports, triaging severity, assigning issues to developers, generating candidate patches and writing tests.

The tools involved included Naptime, built with Project Zero to give models specialised vulnerability-research capabilities, and Big Sleep, an AI-powered discovery agent developed with Google DeepMind and Project Zero that found flaws in the V8 JavaScript engine and Chrome’s graphics components, alongside a Gemini-powered agent introduced earlier in 2026 to search the broader codebase while cutting false positives. Among the finds was a sandbox-escape vulnerability that had sat undetected in the code for more than 13 years; exploited, it would have let a compromised renderer process escape its sandbox and reach local files.

The disclosure came as Google moves toward a faster Chrome release cadence — two-week major releases with weekly security updates, and a pilot of two security releases a week — a schedule the company said the AI-assisted workflow helped make practical. As with other defensive uses of AI in security research, the figures come from the vendor itself rather than an independent audit, and reflect bugs Google chose to fix rather than a complete account of what the tooling missed.