Here is the number that should stop you mid-scroll: in just the last two Chrome release milestones, Google's AI-assisted security team fixed 1,072 bugs — more than the total number patched across the previous 23 months combined.
To appreciate why that stat is staggering, you need a little context about what Chrome actually is. It's not just a browser. With roughly 73% of the global browser market, Chrome is the primary on-ramp to the internet for more than half of all adults alive today. That's approximately 3.5 billion people. When a serious vulnerability slips through, the blast radius is not a data center or a corporate network — it's a meaningful chunk of humanity.
For years, Google's security team was fixing somewhere between 40 and 50 bugs per monthly release milestone. Respectable work, but hardly jaw-dropping. Then something changed. Starting around milestone M146, the numbers began climbing fast — 80 bugs, then 130, then 350. By milestones M149 and M150, the team had crossed four digits.
The driver behind this acceleration is AI, specifically a suite of agents Google has deployed to handle vulnerability discovery, triage, and patch validation. Fuzzing — the practice of bombarding software with malformed inputs to surface unexpected behavior — has been part of Google's security toolkit since at least 2023. But the newer AI agents are doing something more sophisticated: they're identifying bugs, drafting fixes, and helping validate that those fixes don't break anything else in Chrome's famously complex ecosystem of extensions and web compatibility requirements.
That last part matters more than it might seem. Chrome doesn't exist in a vacuum. Every patch has to play nicely with hundreds of thousands of extensions and billions of web pages built to various standards, some of them frankly held together with digital duct tape. A fix that introduces a new breakage is almost as bad as the original bug. The QA burden alone, at this volume, would be impossible to manage with human engineers alone.
There's a wrinkle worth acknowledging here. AI isn't just fixing more bugs — it's also finding more of them. The same tools that accelerate patching are surfacing vulnerabilities faster than any human-led audit ever could. That's net positive for security, but it does mean the pipeline of known issues is growing alongside the capacity to address them. It's a treadmill that moves faster the harder you run.
What Google has essentially built is a closed-loop security operation where AI identifies weaknesses, proposes solutions, and validates the results — with humans still in the mix but no longer the bottleneck. For a product used by half the world's online population, that's not just an engineering story. It's a preview of how critical infrastructure gets maintained at a scale no traditional development team could sustain.