Google's AI agents now generate most of Chrome's security fixes

Google has turned LLM-based agents loose across Chrome’s entire security lifecycle—finding, triaging, and patching vulnerabilities—and says the payoff is a sharp jump in fixes. Across the two most recent Stable milestones, Chrome 149 and 150, the team closed 1,072 security bugs, more than the previous 23 milestones combined. The effort builds on years of work: LLM-assisted fuzzing in 2023, Project Zero’s Naptime in 2024, and the Big Sleep discovery agent in 2025. A Gemini-driven harness deployed in early 2026 surfaced a renderer sandbox escape that had gone unnoticed for over 13 years, which the team frames as its proof-of-concept moment for AI vulnerability hunting.

The pipeline now leans on multiple cooperating agents. Discovery uses both open-weight and proprietary models, grounded by a knowledge base of Chrome’s CVE history and full Git log, plus developer-authored SECURITY.md files that teach models the codebase’s trust boundaries; a separate ‘critic’ agent checks that context. Triage—historically 5 to 30 minutes of human work per report—is largely automated, filtering spam, reproducing bugs, attaching severity and metadata, and routing to owners, saving an estimated hundreds of developer-hours monthly. For remediation, a fixing agent proposes candidate patches, a critic loop mimics code review against Chromium style rules, and test-writing agents validate across supported platforms. Big Sleep and CodeMender run through CI every 24 hours against all changelists.

The surge in AI-found bugs also reshaped Google’s bug bounty. By March 2026 external researchers were filing more reports than in all of 2025, prompting Google to refocus the Vulnerability Reward Program on submissions that are additive to what its own tooling already catches and that fit its automated intake. Google stresses guardrails around the AI: models analyze source at rest on locked-down machines with no general internet access, network requests pass through strict allowlists, and subagents can’t modify the system or reach outside designated source directories. The clear signal for the wider industry is that automated vulnerability discovery has crossed from research demo into production scale—and defenders will need matching automation to keep pace.