A decade ago, **Google Chrome** pioneered automatic updates, a then-controversial practice that has since become the industry standard. Today, with AI-powered vulnerability hunting creating a "torrent of bugs" across all software, the frequency and quantity of patches are skyrocketing. In a recent report, the **Chrome** security team revealed that its two major version releases in June addressed an astounding 1,072 security bugs. This figure represents more patches than the team shipped in the prior 23 big releases combined. ### AI at the Forefront of Bug Hunting While some vulnerabilities come from external researcher submissions, the significant spike is primarily attributed to **Chrome**'s rapidly evolving internal process of leveraging AI tools for vulnerability discovery, triage, and patch development. **Parisa Tabriz**, **Chrome**'s Vice President and General Manager, noted, "In **Chrome** we’ve been using machine learning—using AI before it was called AI—to help find vulnerabilities in particular and automate security fuzz testing work since at least 2012... But I do think this year is very different. It really feels like an inflection point both for offense and defense." ### Accelerating Patch Cadence **Chrome** is already shifting towards a new normal of major releases every two weeks, supplemented by weekly security updates. However, the intensity of recent vulnerability discoveries, coupled with the success of integrating new AI models, has prompted the team to pilot a cadence of releasing security fixes twice a week. **Doug Turner**, **Chrome**'s Director of Engineering, explained, "The way we ended up here is we had so many vulnerability fixes, so being able to provide two [updates per week] during this time, it made the most sense to us. Will that last forever? Who knows." ### The Future of AI in Security **Turner** suggests that this AI-driven vulnerability boom might not last indefinitely for mature products like **Chrome**. AI models, trained with an encyclopedic understanding of past vulnerabilities (every **CVE** and bug) and every line of code change in **Chromium**'s history, can efficiently identify weaknesses across the massive codebase, including in less actively developed features. Beyond reactive patching, the **Chrome** security team is also focused on structural changes, such as rewriting portions of C++ code in the more memory-safe programming language **Rust**, to eliminate entire categories of common bugs. **Tabriz** anticipates a "new equilibrium" in the long term. "Across the industry I think it’s really important that people who are building and thinking about software security are incorporating AI into their development workflows. My highest hope is that everything gets more secure. But I don’t assume everything is going to just get better. I don’t think it’s going to come for free."