How many Chrome security bugs did AI help fix?

Google's Big Sleep and Gemini-powered agents helped Chrome patch 1,072 security bugs in Chrome 149 and 150, both shipped in June 2026. That single two-version run beats the 1,036 bugs Google fixed across the previous 23 milestone releases over roughly two years.

What are Big Sleep and the Gemini vulnerability agent?

Big Sleep is a joint Google, DeepMind, and Project Zero AI agent that hunts memory-safety bugs in V8 and the graphics stack. The second system is a Gemini-based agent harness Google built in early 2026 to scan the broader Chromium codebase with higher efficiency and lower false-positive rates.

What was the 13-year Chrome vulnerability the AI found?

One AI-discovered flaw was a sandbox escape that would let a compromised Chrome renderer trick the browser into reading local files. Google says the bug had 'quietly survived in our codebase for more than 13 years' before an AI agent surfaced it in the Chromium source.

Does Chrome still need human review?

Yes — Google says its engineers still validate, triage, and land every AI-suggested fix. The AI's role is to speed up finding and preemptively patching bugs, not to ship code unattended; Chrome director of engineering Doug Turner says the goal is to 'outpace our adversaries' by fixing issues before attackers exploit them.

Google · 2026-07-30 · major

Chrome fixed 1,072 bugs with AI — Google's Big Sleep found a 13-year sandbox escape

Google says Chrome 149 and 150 fixed 1,072 security bugs in June — more than the last 23 versions combined. Big Sleep, a joint Google, DeepMind, and Project Zero agent, plus a Gemini-driven scanner did most of the finding.

Google blog header for Chrome AI security update

AI agents patched more Chrome security bugs in June than the browser fixed across its last two years of releases.

Quick facts

Maker	Google (Chrome + DeepMind + Project Zero)
Bugs fixed	1,072 in Chrome 149 + 150
Prior baseline	1,036 bugs across the last 23 versions
AI agents	Big Sleep (V8 + graphics) and a Gemini vulnerability agent
Notable find	Sandbox escape latent for 13+ years
Published	July 30, 2026

What is it?

Google shipped 1,072 security fixes across Chrome 149 and 150 this June — most of them surfaced by two AI vulnerability-hunting agents. One is Big Sleep, a joint Google, DeepMind, and Project Zero project that focuses on V8 and the graphics stack. The other is a newer Gemini-based agent harness Google built in early 2026 to scan the wider Chromium codebase.

How does it work?

Big Sleep, launched with DeepMind and Project Zero in 2025, runs fuzz-and-reason loops on Chrome's most attacker-facing code and reports concrete memory-safety issues. The Gemini agent walks Chromium's broader tree, filtering for lower false positives so engineers spend less time triaging noise. Google says AI is also now used to validate, triage, and draft fixes, a workflow that used to take 5–30 minutes per report and relied entirely on human security engineers.

Why does it matter?

Chrome runs on billions of devices, so unpatched browser bugs are among the most abused attack surfaces on the internet. Doing the last 23 releases' worth of fixing in two point releases means Chrome is closing off attacker footholds faster than the traditional human-only pipeline could. One AI-found flaw — a sandbox escape that would leak local files to a compromised renderer — had hidden in the code for more than 13 years.

Who is it for?

browser security engineers, Chrome enterprise admins, and anyone tracking how AI agents plug into real production security work

Frequently asked questions

How many Chrome security bugs did AI help fix?: Google's Big Sleep and Gemini-powered agents helped Chrome patch 1,072 security bugs in Chrome 149 and 150, both shipped in June 2026. That single two-version run beats the 1,036 bugs Google fixed across the previous 23 milestone releases over roughly two years.
What are Big Sleep and the Gemini vulnerability agent?: Big Sleep is a joint Google, DeepMind, and Project Zero AI agent that hunts memory-safety bugs in V8 and the graphics stack. The second system is a Gemini-based agent harness Google built in early 2026 to scan the broader Chromium codebase with higher efficiency and lower false-positive rates.
What was the 13-year Chrome vulnerability the AI found?: One AI-discovered flaw was a sandbox escape that would let a compromised Chrome renderer trick the browser into reading local files. Google says the bug had 'quietly survived in our codebase for more than 13 years' before an AI agent surfaced it in the Chromium source.
Does Chrome still need human review?: Yes — Google says its engineers still validate, triage, and land every AI-suggested fix. The AI's role is to speed up finding and preemptively patching bugs, not to ship code unattended; Chrome director of engineering Doug Turner says the goal is to 'outpace our adversaries' by fixing issues before attackers exploit them.

Try it

Update Chrome via chrome://settings/help — the fixes ship in the stable 149 and 150 milestones