Google fixed more Chrome bugs in June than over the past two years, thanks to AI

Who Should Read

Backend or security developers building agent pipelines for automated code analysis and fixing

Core Mechanics

• 1072 security bugs fixed in Chrome 149 and 150
  • That exceeds the total fixed across the prior 23 milestones combined.
  • The article counts by milestone (release), not by month.
  • It covers security bugs, not bugs in general.
• Finder agent got a knowledge base
  • All past CVEs and Chrome's full Git history extend the model's reasoning beyond its training data.
  • It supports both open-weights and proprietary models.
  • It runs over the codebase multiple times to cover model non-determinism.
• SECURITY.md plus a critic agent
  • Developers write trust boundaries and threat models in SECURITY.md.
  • A critic agent with a separate context reads it to review findings.
• Triage automated in four phases
  • It filters spam and duplicates, reproduces, enriches metadata, and assigns an owner.
  • Triage once took 5 to 30+ minutes per report, and Google estimates hundreds of hours saved per month.

Community Reactions

• Title called inaccurate
  • Several commenters said the numbers are per milestone, not per month, and cover only security bugs.
  • One said the latest milestone alone did not exceed the previous two years.
• Missing validation metrics
  • Commenters asked how many automated fixes were reverted, introduced new bugs, or what the false positive rate is.
  • Others asked how many bugs were AI-introduced in the first place.
• LLM as an expensive intelligent linter
  • One commenter said LLM linting caught hard-to-spot bugs in old critical code at work.
  • The same commenter said generic LLM code review is mostly noise that people ignore.
• Weak for performance tuning
  • One commenter said AI-flagged SQL issues rarely changed performance in back-to-back tests.
  • It did help apply changes they had already decided on.

How to Apply

• Write a SECURITY.md for your repo
  • Spend 30 minutes today listing trust boundaries, external input entry points, and high-privilege modules.
  • Feed it as context to your LLM review or security check prompts.
• Split finder and critic agents
  • Run the vulnerability finder and a critic in separate contexts.
  • Give only the critic the SECURITY.md to filter false positives.
• Scan the same code multiple times
  • Run the same directory several times to account for non-determinism and merge results.
  • Lock agents down with no internet, allowlists, and read-only access to designated directories.
• Add a diff scan to PRs
  • In CI, send only the diff to the LLM to flag risky patterns like dangling pointers or numeric overflow.
  • Post results as comments for humans, not auto-fixes.

Try It

# Paste into Claude or ChatGPT (simplified version of Chrome's SECURITY.md + critic approach)

[Role] You are a vulnerability-finding agent.
[SECURITY.md]
{{SECURITY.md content}}
[Code]
{{code to review}}

Using the trust boundaries above, find vulnerability candidates. For each, give file/function, attack scenario, and the evidence lines.

---
(In a new conversation) You are a critic. Using only the SECURITY.md and candidate list below, judge whether each is a real vulnerability. For false positives, give a one-line reason.
[SECURITY.md]
{{SECURITY.md content}}
[Candidates]
{{results above}}

Next: run the same code 3 times and compare how much the results overlap.

Terminology

Related Papers

• Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

  Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.

• Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

  Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.

• Harness Engineering 101: The LLM is the brain, the harness is the body

  An agent is a loop managing a JSON array; 16 chapters build one from scratch

• Harness2 by Google Research – Recursive Agent Harnessing

  Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.

• Ousted Savannah police officer gave ICE agent husband access to Flock system

  A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired

• Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling

  Running Claude Code agents in tmux works well, but limits appear around four agents.

Related Resources

• https://blog.google/security/chrome-stronger-with-every-update/