Google Fixed 1,072 Security Bugs in Chrome Using AI Agents
PawelHuryn · x · 2026-07-31
Google's Chrome Security team used LLMs to fix 1,072 security bugs in June—more than the previous two years combined. The team detailed their AI engineering practices:
- Knowledge Base: Built a comprehensive database of all known Chrome CVEs and the entire Git history.
- Security Documentation: Used SECURITY.md files to document the security assumptions of each component.
- Critic Agent: Deployed a separate agent with its own context to review and critique code.
- Multiple Passes: Ran multiple passes over the same code, recognizing that a model might only find a specific bug on the third run.
This marks a massive shift in the software security industry, scaling vulnerability discovery and patching far beyond human limits.
More from coding & agent
- 'LLM code is sloppy' rebutted with real ffmpeg code: identical if/else branches in a top library — kingslyj · 2026-10-16
- Office-editing tool calls need file, worktree and unit: lessons from dsh-univer-office — FunDistribution6537 · 2026-10-16
- Architect MD workflow: Gemini one-shot outputs that beat Opus, via 5-lens plan critique — oikk01 · 2026-10-16
- Prove a coding agent actually ran the tests: check artifacts, not approvals — ComprehensiveShake76 · 2026-10-16
- Building an acceptance harness for AI spreadsheet edits: allowlists, recalc checks, idempotency — ukdicha-modakkk · 2026-10-16
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16