In two browser releases, Google's AI agents identified and helped repair over a thousand security vulnerabilities in Chrome—including a flaw that had quietly persisted for thirteen years—marking a threshold moment in how software defends itself. The machines do not act alone: human developers retain final authority over every fix, and the architecture is carefully bounded. What is unfolding is less a replacement of human judgment than an expansion of human reach, a partnership between tireless algorithmic attention and the wisdom required to know what truly matters.
Google's AI agents fix 1,072 Chrome vulnerabilities, discover 13-year-old sandbox bug
A bug that lived undetected for thirteen years, waiting.
Mark
So Google is saying AI found a bug that sat in Chrome for thirteen years. How does something like that slip through for so long?
Mimi
The sandbox escape was hiding in plain sight—a specific interaction between a compromised renderer and the file system that nobody had thought to look for in quite that way. It's not that the code was obviously broken. It was a logic gap that required understanding both the security boundary and the renderer's capabilities to spot.
Mark
And the AI found it. Does that mean AI is now better at security than humans?
Mimi
Not better—different. The AI can search exhaustively through millions of lines of code without fatigue, checking against patterns it's learned. But it still needs humans to verify the finding is real, that the fix is sound, and that it doesn't break something else. The human is the final gate.
Mark
You mentioned the Patch Gap. That sounds like a real vulnerability in itself.
Mimi
It is. The moment a patch goes public, attackers have a roadmap to the bug. They can study the fix and understand what was broken. Google's trying to shrink that window—faster releases, automatic restarts, eventually dynamic updates where you don't have to restart the whole browser.
Mark
How long is the gap now?
Mimi
It depends on how quickly users update. For some, it's days. For others, weeks. That's why Google's pushing toward two-week major release cycles instead of longer ones.
Mark
If AI is generating patches, does that mean fewer human security engineers?
Mimi
No. It means the engineers spend less time on routine triage and more time on judgment calls—deciding if a fix is actually correct, if it meets standards, if it introduces new problems. The AI handles the grunt work; humans handle the thinking.
Mark
What happens if an AI-generated patch is wrong?
Mimi
A human catches it before it ships. That's the whole point of keeping developers in the approval loop. The AI proposes; the human disposes.
El Pulso
- A thirteen-year-old sandbox escape—capable of letting attackers read local files through a compromised browser process—was finally surfaced not by a human auditor, but by an AI agent scanning code no one had looked at closely enough.
- The scale is disorienting: two Chrome releases eliminated more bugs than the previous twenty-three combined, forcing a reckoning with how much vulnerability quietly accumulates in complex software over time.
- Google has layered its AI systems with strict containment—isolated networks, allowlisted connections, directory-limited subagents, and critic models that challenge every proposed fix before a human ever sees it.
- The moment a patch appears in a public repository, attackers can reverse-engineer the original flaw, so Google is compressing release cycles to two weeks and testing dynamic process-level updates that would let Chrome update itself without a full restart.
- Every AI-generated fix is deliberately called a 'candidate patch,' not a repair—a linguistic choice that keeps the human developer's role visible and essential in a process increasingly shaped by machines.
In two browser releases, Google's AI agents identified and helped repair over a thousand security vulnerabilities in Chrome—including a flaw that had quietly persisted for thirteen years—marking a threshold moment in how software defends itself. The machines do not act alone: human developers retain final authority over every fix, and the architecture is carefully bounded. What is unfolding is less a replacement of human judgment than an expansion of human reach, a partnership between tireless algorithmic attention and the wisdom required to know what truly matters.
Google has embedded artificial intelligence into the core of Chrome's security work, and the results are difficult to contextualize without pausing. Across just two browser versions—Chrome 149 and 150—AI agents discovered and helped patch 1,072 security vulnerabilities, more than the previous twenty-three major releases combined. Developers still review every proposed fix and hold final approval authority, but the AI has become the first and most tireless reader of the codebase.
The approach has been years in the making. Google began with AI-assisted fuzzing, then built specialized systems to hunt exploitable bugs independently. When Gemini was turned loose on larger portions of Chrome's code, it found something remarkable: a sandbox escape vulnerability that had gone undetected for thirteen years. A compromised renderer process could have used it to read files directly from a user's local system. It had simply been waiting.
The agents operate within strict boundaries. They access Git history, security disclosures, and component documentation, but run on isolated systems with no open internet access. Separate critic agents challenge every discovery before it advances. When a bug report arrives, the system filters it, attempts to reproduce it across operating systems, and assembles technical context—stack traces, severity ratings, affected components—before routing it to a human owner. Google estimates this saves several hundred working hours each month.
Once a vulnerability is confirmed, the AI generates multiple candidate patches, which critic agents evaluate against Chromium's conventions and security boundaries. Additional agents write tests to verify the fix works across platforms. Only then does a human developer review the proposal. The language is deliberate: these are 'candidate patches,' not autonomous repairs.
The deeper challenge lies in what happens after a fix is published. The moment a patch appears in the public repository, attackers can examine it and reconstruct the original flaw—a window of exposure Google calls the Patch Gap. To close it, the company is moving to two-week major release cycles, continuing weekly security updates, and exploring dynamic updates that would let Chrome replace individual processes like the renderer without restarting the entire browser. In Chrome 150, a version of this already arrived on macOS: if the browser is running in the background with no open windows and an update is pending, it can restart automatically and restore the session seamlessly.
Google has woven artificial intelligence deep into the machinery of Chrome security, and the numbers tell a story of scale that would have been unimaginable just a few years ago. In the span of two browser releases—Chrome 149 and 150—the company's AI agents discovered and helped patch 1,072 security vulnerabilities. To put that in perspective, those two versions together eliminated more bugs than the previous twenty-three major Chrome releases combined. The work is not done by machines alone. Developers still review every proposed fix, verify its correctness, and ensure it meets Chromium's technical standards. But the AI has become the first reader, the tireless searcher, the one that spots what human eyes might miss.
Google's approach to AI-assisted security has evolved over several years. The company began by using large language models to improve fuzzing—the practice of bombarding software with unexpected inputs to find breaking points. Specialized systems followed, with names like Naptime and Big Sleep, designed to hunt for exploitable bugs independently. Earlier this year, Google built an agent environment that turned Gemini loose on larger portions of the Chrome codebase. What it found was striking: a sandbox escape vulnerability that had lived undetected in the code for thirteen years. A compromised renderer process could have used this flaw to read files directly from the user's local system. The bug had been there the whole time, waiting.
The AI agents don't work in isolation or without guardrails. They're given access to Chromium's Git history, previous security disclosures, and technical documentation for each component. Separate critic agents review the discoveries and assess whether a vulnerability actually crosses a security boundary. All analysis runs on isolated systems with no general internet access; network connections are filtered through strict allowlists. Subagents can only touch specified directories and cannot arbitrarily modify the underlying system. The architecture is designed to contain the AI's reach.
The automation begins before any code is even written. When a security bug report arrives, the system first filters it—is it spam, a duplicate, or actually security-relevant? If it passes that gate, the AI attempts to reproduce the bug across different operating systems and browser versions. When successful, it automatically gathers technical data: stack traces, affected components, when the bug was introduced, and a preliminary severity rating. The ticket then routes to the responsible team with a human owner assigned. Google estimates this triage process saves several hundred working hours each month. Developers can still override the system's judgment, changing severity ratings or rejecting reports entirely.
Once a vulnerability is confirmed, the repair process unfolds in stages. An agent analyzes the bug and generates multiple possible code changes. A critic agent compares these proposals against Chromium conventions, existing security boundaries, and the component's technical structure. Additional agents generate automated tests to verify the fix works and that Chrome continues functioning across different operating systems and hardware. Only then does a human developer review the proposed patch. Google calls these AI-generated fixes "candidate patches" rather than autonomous repairs—a deliberate choice of language that acknowledges the human remains essential to the process.
The 1,072 figure requires some unpacking. It counts security bugs found and fixed during development, not necessarily the same as publicly documented CVE numbers. Some vulnerabilities were discovered internally before reaching a stable Chrome version. Others were consolidated or handled without their own CVE identifier. Google also notes that more than twenty vulnerabilities were caught by AI systems integrated into the continuous integration environment before the code ever reached production—prevented before they could become public problems. One of those was classified as S1+, the company's most critical category.
The real challenge, Google recognizes, is what happens after a patch is released. The moment a fix appears in the public Chromium repository, attackers can examine the change and reverse-engineer the original vulnerability. This window—between patch publication and actual installation—is called the Patch Gap, and it's where danger lives. To shrink it, Google is moving Chrome to a two-week cycle for major releases, while continuing weekly security updates and testing two security releases per week. The company is also exploring dynamic updates that would eliminate the need to restart the entire browser. Chrome's multiprocess architecture could theoretically replace individual processes like the renderer or GPU process one at a time with updated versions, keeping the browser running seamlessly. In Chrome 150, Google already introduced automatic restarts for a specific scenario on macOS: if the browser is running in the background with no open windows and an update is pending, it can restart automatically and restore sessions.
Citas Notables
AI does not perform the repairs completely without human oversight. Developers continue to verify whether the proposed changes are correct, complete, and compatible with Chromium requirements.— Chrome Security Team
Google estimates the automated processing of incoming bug reports saves several hundred working hours per month.— Chrome Security Team
Quieres la nota completa?
Lee el original en igor´sLAB ↗
Technology