Google fixed more Chrome bugs this past June than it had fixed in the two previous years combined. The main driver wasn’t a purely human security team, but an AI agent called Big Sleep, built by Project Zero in partnership with DeepMind, to automatically hunt for vulnerabilities. This is a signal that software security work is undergoing a structural shift — from “waiting for someone to find the bug” to “AI hunting down the bug before anyone else can.”
Frankly, if this trend continues, the cybersecurity field won’t be the same again, because AI isn’t just helping write code anymore — it’s starting to take over the parts of professional security work that require combing through millions of lines of code.
(Note: This article compares against iPhone 17 Pro Max spec data that was provided but is unrelated to the Chrome bug topic, so those numbers were not used here.)
The number that makes you stop and look twice
If you plot Chrome’s patch volume over the past two years, you’d see the usual up-and-down line typical of a security team manually combing through code. But this past June, that line jumps out unmistakably — significantly higher than the previous months’ average.
What’s notable is that this timing lines up with when Google started seriously using AI to hunt for vulnerabilities across Chrome’s massive codebase. Work that normally required a person going line by line is now something AI can scan far more broadly and quickly, surfacing long-hidden bugs faster than before.
The time a browser bug nearly cost us for real
Picture a dev team running Chrome all day — logging into company systems, opening client dashboards — and then one day there’s news that a zero-day is being actively exploited in the wild, before Google manages to ship a patch in time. That window between “the vulnerability is known” and “the patch reaches your machine” is the most dangerous stretch, because attackers often know about it before most users do.
This isn’t a distant hypothetical. The browser is the gateway that lets everything from the internet in, from sketchy JavaScript to file attachments. If a vulnerability sits open for weeks, that’s a window where malware or data theft has plenty of time to play out. This is why “how fast bugs get fixed” isn’t just a nice-looking KPI — it’s a real shield between users and actual damage.
Big Sleep isn’t a separate side project — it’s an AI agent Google deployed to work alongside the existing Project Zero and OSS-Fuzz teams, two units that were already hunting vulnerabilities before AI entered the picture. Its job is to scan through Chrome’s code hunting for bugs before attackers find them, instead of waiting for human researchers to fuzz one spot at a time.
Its role is as an “accelerator” within the existing process, not a wholesale replacement system. The Chrome Security team still makes the final call on patches — AI just helps dig through a massive volume of code that humans couldn’t keep up with on their own.
The timing of Google’s disclosure is straightforward too — the number of bugs fixed in June spiked clearly compared to the previous two years, tangible evidence that this model is actually running in production, not just a paper demo.
How different is “before AI” versus “after AI”?
| Factor | Before AI assistance | The Big Sleep era |
|---|---|---|
| How bugs are found | Security team manually reviews code + traditional fuzzing | AI automatically scans a massive volume of legacy code |
| Speed of finding vulnerabilities | Limited by headcount, reviewed piece by piece | Continuous parallel scanning, no human downtime needed |
| Who makes the final patch call | Security team | Security team (unchanged) |
The clearest difference isn’t “humans got replaced” — it’s the scope of work AI expands. Old code that piled up because no one had time to review it now gets scanned by AI first for vulnerabilities, then handed to the security team for confirmation.
Google didn’t disclose a detailed year-over-year bug count in this report, but the direction is clear: the number of bugs fixed per release cycle has increased significantly since Big Sleep was brought seriously into the code-review pipeline.
What this AI actually changes for real browser users
Picture someone doing mobile banking transfers through Chrome every month — a vulnerability that used to slip through because the security team couldn’t keep up with reviewing every line of C++ code is now something an AI agent helps simulate attacker behavior for and dig up before it gets exploited.
IT admins managing thousands of enterprise machines benefit directly too. Tighter patch cycles mean a shorter exposure window — no more gambling on which machine gets hit first.
Web developers who live in Chrome DevTools every day are indirectly affected as well, since a more stable and secure engine means code that’s already been deployed becomes safer too, without the dev team having to do anything extra.
Put simply: AI isn’t replacing the security team — it’s acting as a filtering layer, letting a limited number of people focus on the cases that actually matter.
Google isn’t competing alone
Chrome isn’t the only browser dealing with a massive bug volume — each competitor has its own approach, but the degree to which they’ve brought AI into bug-hunting differs sharply.
Microsoft has pushed Security Copilot to help its analyst teams with threat analysis in Edge/Defender, but it’s still a tool that assists analysts, not an automatic bug-finder the way Google is doing directly with Chrome. Mozilla still relies mainly on bug bounties and manual review, which is slower in terms of scale. Apple has chosen the closed-system (walled garden) route, reducing the attack surface from the source rather than patching after the fact.
Each approach has its own trade-offs — there’s no single formula that’s clearly best.
| Factor | Google Chrome | Microsoft Edge | Mozilla Firefox | Apple Safari |
|---|---|---|---|---|
| Main approach | Automatic AI bug-hunting | AI-assisted threat analysis | Bug bounty + manual review | Closed system, reduced attack surface |
| Patching speed | Clearly faster (June) | Depends on analyst team | Depends on external researchers | Patches follow iOS/macOS cycle |
| Model | Open engine, closed bug source | Closed ecosystem | Open source | Closed ecosystem |
Pros and cons worth weighing
AI is helping find bugs in Chrome at a depth that manual teams could never keep pace with — but there are risks worth watching just as closely.
Pros
- +Clearly faster security bug patching in the June cycle
- +Finds deep, subtle bugs too difficult for human code review alone to catch
- +Reduces the burden on a limited manual review team, freeing them to focus on complex cases
Cons
- −Risk of over-relying on AI, leaving the team without deep root-cause understanding
- −AI can misjudge false positives/negatives — human re-verification is still always required
- −The AI bug-triage process still isn't transparent enough for full external auditability
The common thread on both sides: AI is a tool that assists, not a full replacement for the security team — final sign-off still requires a human.
The costs that don’t make it into the press release
Running an AI agent to continuously scan the entire Chrome codebase isn’t free — compute scales with the codebase’s ever-growing size, and it has to re-run every time there’s a new commit.
Heavier still is the human team that has to verify every case the AI flags. The more bugs it finds, the more review work piles up — it doesn’t reduce the security team’s workload so much as change its shape.
Another concern is responsible disclosure timing — if AI finds a vulnerability faster than the dev team can patch it, the window where a bug is known but not yet closed could actually get longer instead of shorter.
The question that’s still unanswered is who bears this cost long-term — users, through increased telemetry collection to feed the AI, or third-party developers, through ever-tightening compliance requirements.
What this foreshadows for the software we use every day
The industry’s next challenge isn’t just “finding the bug” — it’s “closing the bug before whoever else found it can exploit it.” If defensive AI keeps getting better, offensive actors are using AI to scan for vulnerabilities faster too, turning this into a pure speed race rather than just a battle of skill and knowledge.
Chrome may just be the starting point. Next we might see mobile OSes, banking apps, or even IoT firmware adopt the same kind of AI-driven code review. The question is whether small dev teams without the resources to keep up can stay on pace with this trend.
What ordinary users can do right now is keep browser auto-update turned on and never delay patches — because that exposure window mentioned above gets shorter or longer depending on whether you update in time. Keep following AI security news, because by next year, stories like this won’t be novel anymore.