Google's AI Fixed 1,072 Chrome Security Bugs in One Month
PawelHuryn · x · 2026-07-31
Google fixed 1,072 security bugs in June using AI, surpassing the total of the previous two years combined. The author details the automated engineering architecture Google built around the model:
- Knowledge Base: Integrates a database of every known Chrome CVE and the entire Git history.
- Security Assumptions: Leverages SECURITY.md files to document each component's security prerequisites.
- Multi-Agent Collaboration: Uses a Critic Agent with its own context to loop with a Fixing Agent, mimicking human code review.
- Redundancy & Testing: Runs multiple passes over the same code to catch missed bugs, alongside test-writing agents that verify fixes across all Chrome platforms before developer involvement.
This system even uncovered a sandbox escape vulnerability that had survived in the codebase for over 13 years. The author argues that AI has become scarily good at coding, signaling the end of manual code reviews.
More from coding & agent
- 'LLM code is sloppy' rebutted with real ffmpeg code: identical if/else branches in a top library — kingslyj · 2026-10-16
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16
- Vitalik builds "paranoid mode" agent wrapper with Tor, zkAPI and local prompt rewriting — DavideCrapis · 2026-10-16
- Agent fine-tunes Qwen3.5-0.8B with synthetic data: 4.7%→76.3% accuracy, 11.9× faster — ben_burtenshaw · 2026-10-16
- Beam-501B agent demo: solo beats 5-agent team on ProgramBench rebuild task — ben_burtenshaw · 2026-10-16
- Beam agent builds BeamSpeak, a local Parakeet dictation app for macOS — ben_burtenshaw · 2026-10-16