Chrome’s security team is deploying large language models (LLMs) to find and fix bugs faster than ever. In 2023, the teamTensor improved fuzzing, and in 2024 they partnered with Project Zero on Naptime. By 2025, DeepMind collaboration yielded Big Sleep, uncovering bugs in V8 and the graphics stack. Early 2026 saw an agent harness using Gemini to scan the entire Chrome codebase, discovering a sandbox escape that had lingered for over 13 years. The process involves finding, triaging, fixing, and releasing updates, with AI shortening each step.

AI-driven triage replaces manual reviews, filtering spam, reproducing proofs of concept, enriching metadata, and auto‑assigning issues. This saves hundreds of developer hours per month. Fixing uses multi‑agent workflows: a fixing agent proposes candidates, a critic selects the best, and test‑writing agents generate coverage tests. The result is a dramatic jump in fixes—Chrome 149 and 150 fixed 1072 security bugs, exceeding the previous 23 milestones combined.

These tools run continuously in CI every 24 hours, scaling discovery and remediation while safeguarding against AI misbehavior with strict network and file access controls.

The approach showcases how AI can surpass human limits, accelerating security resilience in the web ecosystem.