In the last two Chrome releases, Google fixed 1,072 security bugs. That’s more than the previous 23 milestones combined. AI wrote most of the fixes.
That chart is what software productivity gains actually look like when AI moves from experiment to pipeline. Two years of flat patch rates, then a spike that dwarfs everything before.
What Google built
The Chrome Security Team published a detailed account of how they got there. It’s not one AI tool - it’s a pipeline with AI at every stage.
Gemini continuously scans the codebase against a knowledge base of every prior CVE and the full git history. In early 2026, this caught a sandbox escape bug that had quietly lived in the code for more than 13 years. Triage - historically five to thirty minutes of expert human time per report - is now largely automated, saving hundreds of hours of developer time a month. A multi-agent fixing workflow generates candidate patches, runs a critic agent, loops through code review and writes tests before a human sees any of it. In May alone, the system blocked over 20 vulnerabilities from reaching production.
Finding, triaging, fixing, testing, releasing - every stage accelerated simultaneously. The 1,072 fixes aren’t a one-off sprint.
The arms race
Here’s the problem: the same capability is available to attackers.
Google’s own report is explicit. LLMs are “unlocking unprecedented capabilities for automated vulnerability discovery, scaling far beyond the limits of human security expertise.” That sentence describes defenders. It also describes the people trying to get in.
In March 2026, Google received more bug bounty reports than it had in all of 2025. Some of that is legitimate researchers working better. Some of it is the same tools pointed the other direction. The patch gap - the window between a fix landing in an open codebase and reaching users - becomes critical when AI can reverse-engineer an exploit in hours. Two security releases per week and dynamic patching aren’t efficiency improvements. They’re a response to an accelerating threat.
Developers who aren’t using AI to find and fix bugs aren’t just moving slower. They’re operating in a different era. One where the other side may already have tools you don’t.
Sources:
- Stronger with every update: How we’re making Chrome and the web safer in the AI Era - Chrome Security Team, Google