The number that matters is 1,072: security bugs fixed in Chrome 149 and 150, the two milestones Google shipped in June. In a July 30 post, 'Stronger with every update,' the Chrome Security Team says that surpasses the total fixed across the previous 23 milestones combined, 1,036 bugs in two years, per TechCrunch's count. The same post names the finder's employer: a Gemini-powered agent harness that has been scanning the broader Chrome codebase since early this year, with what Google calls higher efficiency and lower false positives than its predecessors.
The lineage of that harness is the short history of AI bug hunting: LLMs boosting fuzzing in 2023, the Naptime project with Project Zero in 2024, Big Sleep with Google DeepMind in 2025, and now the general-purpose harness, which works with a knowledge base of every past CVE and Chrome's entire Git history, SECURITY.md files for trust boundaries, a critic agent, and repeated runs to handle model non-determinism. Its trophy case already includes a sandbox escape that would let a compromised renderer read local files, a bug that, in Google's words, quietly survived in the codebase for more than 13 years. Guardrails matter for a system like this, and Google says the analyzed code stays at rest on locked-down machines without general internet access, behind network allowlists.
The pipeline numbers show what happens when finding stops being the constraint. By March, the Vulnerability Rewards Program had already received more reports than in all of 2025, forcing Google to re-scope it to submissions additive to internal findings. A four-phase automated triage, filtering spam, reproducing proofs of concept, enriching severity metadata and auto-assigning, saves what Google estimates as hundreds of developer-hours a month. Big Sleep and the fix-writing CodeMender now run in CI every 24 hours across all changelists, and in May they blocked more than 20 vulnerabilities from reaching production, including one rated critical. On the other end, Chrome is piloting two security releases per week to close the patch gap, with auto-restart updating on macOS and 'dynamic patching' in development.
The honest frame for this comes from Google's own people. Chrome engineering director Doug Turner told TechCrunch that LLMs have 'fundamentally shifted the economics of cybersecurity, transforming vulnerability discovery into an automated, industrial-scale operation,' and VP Parisa Tabriz told WIRED this year is 'an inflection point both for offense and defense.' The offense half of that sentence is the part to hold onto: the same economics now apply to whoever is looking for the same bugs with worse intentions, which is why the patch cadence, not the find count, is the number that decides whether users are safer. Microsoft's record 570-flaw July Patch Tuesday, also AI-assisted, and Apple's un-spiked 482 fixes this year say the curve is real but uneven. The bugs were always in the code. What changed in June is that finding them got cheap, and fixing them became the bottleneck everyone can see.