Google Is Now Patching Chrome Twice a Week — Blame the AI Bug Hunters

Chrome users have gotten used to a steady drumbeat of security updates over the years. That drumbeat just turned into something closer to a sprint. Google's Chrome security team is now piloting a schedule of pushing security fixes twice a week, a pace driven almost entirely by how effective AI tools have become at finding bugs in the browser's code, according to a report the team published Thursday.

The numbers behind that decision are striking. Chrome's two major version releases in June together patched 1,072 security bugs. For context, that's more fixes than the browser's previous 23 major releases combined, according to Google. Some of those bugs came in through the usual channel of outside researchers submitting reports, but the bulk of the surge traces back to Chrome's own internal process for using AI in hunting down, sorting, and fixing vulnerabilities.

Chrome has actually been down this road before, just at a much smaller scale. Parisa Tabriz, Chrome's vice president and general manager, told Wired that the team has used machine learning to find vulnerabilities and automate fuzz testing (a technique where software is bombarded with malformed or random data to see what breaks) since at least 2012, long before "AI" became the industry's default buzzword. But she says this year feels categorically different.

"It really feels like an inflection point both for offense and defense," Tabriz said.

From six weeks to twice a week

It's worth remembering how radical Chrome's update habits once seemed. A decade ago, Chrome was the first major browser to roll out automatic updates, and shipping security patches every six weeks was considered aggressive. That cadence has already tightened considerably: Chrome has been moving toward releasing a major version every two weeks, with weekly security updates layered on top. Now, given the sheer volume of vulnerabilities AI tools are surfacing, the team is testing a schedule of two security releases per week.

Doug Turner, Chrome's director of engineering, said the shift wasn't a grand strategic plan so much as a practical response to a flood of fixes that needed somewhere to go. "The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us," Turner told Wired. Whether that pace sticks is an open question even inside the team. "Will that last forever? Who knows," he added.

Why AI is so good at this

Part of what makes AI-assisted bug hunting so potent right now is context. Turner described training models on the entire history of Chromium, the open-source project underlying Chrome, so the system has effectively memorized every publicly known vulnerability (every CVE, the standard tracking number assigned to disclosed security flaws) along with the reasoning behind past code changes.

"We're training our model such that it knows about every security vulnerability that we have seen in the past," Turner said. "So every CVE, every bug the model knows about. And the second really cool thing is every line of code in Chromium's history, it knows the reason why that line was changed."

That depth of institutional memory lets AI tools comb through Chrome's sprawling codebase and flag weak spots that might otherwise go unnoticed, particularly in older features like printing support that aren't under active development anymore and don't get much scrutiny from human engineers day to day.

A spike, not necessarily a new normal

Turner and other security researchers cited in the report see signs this current surge could taper off, at least for mature, well-established software like Chrome. Once AI tools have chewed through the backlog of findable bugs in a stable codebase, the theory goes, the discovery rate should naturally slow down.

That's not the only front the Chrome team is fighting on. Alongside the reactive work of patching bugs as they surface, Tabriz and Turner pointed to structural changes meant to eliminate entire categories of vulnerabilities outright, most notably rewriting portions of Chrome's C++ code into Rust, a programming language designed to prevent common memory-related bugs by construction rather than catching them after the fact.

Tabriz framed the current crunch as temporary but consequential for how the whole industry approaches software security going forward. "There's this near-term spike, but I do think there's going to be a new equilibrium," she said. "Across the industry I think it's really important that people who are building and thinking about software security are incorporating AI into their development workflows."

She was careful not to promise a clean outcome, though. "My highest hope is that everything gets more secure," Tabriz said. "But I don't assume everything is going to just get better. I don't think it's going to come for free."

That caveat cuts both ways. The same AI capabilities helping Chrome's defenders find and fix flaws faster are available, in some form, to attackers looking for the same weaknesses first. For now, Google's answer is simply to patch faster than anyone can exploit what AI turns up, twice a week, for as long as that's what it takes.