AI has intensified the software security threat landscape, but an increase in the number of vulnerabilities found and fixed is not a sign of failure. That’s the argument that Google has put forward in a new posting by the Chrome security team, backed up by plenty of real-world and technical context. But coming hot on the heels of the OpenAI Hugging Face security incident, which detailed how a supposed rogue AI could hack unsuspecting third-party companies, there has been plenty of online conversation around whether AI is a friend or foe in security. The truth, of course, is that it can be both. So, let’s take a closer look at Google’s argument that every Chrome security update not only makes the browser safer, but the broader web as well, with the deployment of AI models at scale behind the scenes.
Every Chrome Update Makes The Web A Safer Place, Google Says
I have long argued that the more vulnerabilities found, and crucially fixed, within any codebase is a sign of strength, not weakness. Nowhere, I would suggest, is this more evidenced than with Google Chrome, or to be more precise, the Chromium codebase that powers the world’s most popular web browser. The latest Chrome security update, for example, addressed 370 vulnerabilities and fixed them all before any attackers were known to have exploited them in the wild. This is a good thing, as I have reported, because it is “far better that Google is made aware of these flaws before threat actors, and far better it rolls out fixes as soon as it can for all of them before they are used for malicious purposes.” Google’s July 30 Chrome security team posting makes the same argument, with a lot of very compelling behind-the-scenes context to demonstrate exactly why this is the case.
While conceding that large language models continue to reveal their capacity for automated security vulnerability discovery at scale, in an unprecedented fashion that pushes far beyond the capacity of humans alone, Google said that this requires new approaches for staying ahead of attackers. “This means deploying AI models at scale to find and fix hundreds of security bugs, faster than ever,” the lengthy Stronger with every update: How we’re making Chrome and the web safer in the AI Era document said, “with the goal of achieving greater resilience and comprehensive remediation.”
With the whole Hugging Face OpenAI story still hogging the headlines, it’s notable that Google has opted to make a point of pushing the safety guardians narrative when it comes to the use of AI in Chrome vulnerability discovery and mitigating the risk of said AI exhibiting unexpected behavior. “Our AI analyzes source code strictly at rest, operating on locked-down machines that lack general internet access,” Google said, adding that it utilizes “a dedicated setup for these internal scans that intercepts all network requests, employing strict allowlists based on the initiating application and destination, blocking any suspicious model activity.”
How Google Employs AI For Vulnerability Discovery, Triage And Remediation
Google summed up its approach as involving discovery, triage and remediation. Using AI for discovery is not new, and Google has been doing so “for years,” it said. Indeed, in 2023 it started using LLMs for increased fuzzing coverage, where random unexpected data is input to uncover potential coding errors, and providing these LLMs with “specialized tools for vulnerability research” the following year. More recently, Google has employed the Big Sleep AI vulnerability discovery agent to uncover flaws in the V8 JavaScript engine and graphics stacks, and an agent harness deploying Gemini across the broader Chrome codebase that found a vulnerability that had been quietly sitting in place for 13 years.
As far as the triage component is concerned, Google said it is using AI to automate the validation process that, traditionally, can take expert human operators 30 minutes or more to produce a report. “We have been increasingly shifting our triage process towards an automated approach,” the Chrome security team confirmed, blending “rule-based systems with AI to increase throughput and accuracy.” This involves filtering out noise to ensure it’s not spammy or duplicated, reproducing the actual bug itself, adding essential metadata such as dates and severity scores, before automatically routing the vulnerability report “to the correct component and human owner.” The end result, while being a best guess by Google, is a “saving hundreds of hours of developer time per month.” Hours that can then be focused on other security issues.
Which brings us to the all-important remediation process. Once again, AI is having a measurable impact courtesy of the use of multi-agent workflows. A fixing agent is deployed to return multiple potential fixes and a critic agent evaluates these, working in a loop that mimics traditional developer code reviews. Then there’s the test-writing agent that ensure the patching works across all Chrome-supported platforms and configurations. This is done “before a developer reviews the fix,” Google confirmed, “saving up to weeks of developer time.” Indeed, in 2026, Google now has LLMs generating candidate fixes for most vulnerabilities, “dramatically increasing the rate of security fixes in recent Chrome releases,” the report said.
So, Is Google Right—Is The Web Safer Thanks To Chrome And AI?
Anything that helps to minimize the so-called patch gap, the time between vendor vulnerability discovery and client update remediation, is certainly not making the web a less safe place. There is no doubt that AI has been a critical cog in the Chrome security machine that helps Google to get security updates out faster and faster, and will likely continue to accelerate this process. Google itself confirmed in the Chrome security team posting that it is piloting a shift to twice-weekly security releases in the face of the increased vulnerability discoveries, which is down, in large part, to the success of the aforementioned AI toolings and processes. As regular readers will be able to testify, I am not always the most supportive Google voice in the ether, but credit where it is due: and it’s due here. “By combining rapid deployment mechanisms with deep structural defenses,” Google said in the face of the AI threat landscape, “we are ensuring the advantage remains firmly with defenders. With this, Chrome and the broader web become safer with every update.” I find that hard, dear reader, to argue with.
