Google Uses AI to Help Fix 1,072 Chrome Security Bugs
By Lakxhya Vishnoi · · 553 words
Topics: AI, Tech, Agentic AI, AI Agents, AI Code Review, AI in Cybersecurity, AI Security, Artificial Intelligence
What are security bugs?
A security bug is a flaw, error, or unintended behaviour in software, hardware, or system configurations that can negatively affect security. While not every bug creates a security vulnerability, some bugs can be exploited by attackers to gain unauthorised access, disrupt operations, leak sensitive information, or execute malicious code.
Security bugs can create security risks because modern applications and systems often contain large codebases, increasing the likelihood of implementation errors.
Security bugs becoming security vulnerabilities
A bug becomes a security vulnerability when it creates a weakness that attackers can exploit.
A typical progression looks like this:
- A coding, design, or configuration error is introduced.
- The flaw remains undetected during development or testing.
- Attackers discover the weakness through research or scanning.
- The bug is exploited to compromise confidentiality, integrity, or availability.
- Organisations must patch or mitigate the issue to prevent further abuse.
Not all bugs are exploitable, but those affecting authentication, memory management, or input validation often pose significant security risks.
How Google AI supercharged Chrome Security
Large Language Models (LLMs) are unlocking unprecedented capabilities for automated vulnerability discovery, scaling far beyond the limits of human security expertise, and requiring new approaches for staying ahead of attackers.
This means deploying AI models at scale to find and fix hundreds of security bugs, faster than ever, to achieve greater resilience and comprehensive remediation.
In the last two milestones, Chrome 149 and 150, they have fixed 1072 security bugs, surpassing the total number of security bugs fixed across the prior 23 milestones combined.
Google upped its game with an agentic harness (a structure for interacting with LLMs) based on Gemini that was designed to find vulnerabilities across the entire Chrome codebase.
To achieve this, they used multi-agent workflows throughout:-
- After initial build steps that bring in context from a specific issue, they run a fixing agent that returns multiple candidate fixes.
- A critic agent then evaluates which would be the best fit, producing other relevant artifacts for developers to evaluate the fix.
- The fixing and critic agents work in a loop that mimics a typical code review process to ensure that code is functional and compliant with Chromium and Google style guidelines, as well as other local code conventions.
- Test-writing agents help write tests for fixes. These agents can ensure that tests work across the full array of Chrome supported platforms and configurations before a developer reviews the fix, saving up to weeks of developer time.
In general, the application of AI by Google to security within Chrome demonstrates the effectiveness of leveraging machine-driven processes when complementing human abilities, which in this case were developers. The utilization of the power of large language models, together with agentic systems and multiple-agent processes, enabled the discovery and resolution of more security issues than would have been possible through manual means. This example is significant since the problems addressed were potential security vulnerabilities that, if discovered by malicious users, could be exploited. Therefore, while it is essential to leave the final reviewing and approval of such changes to humans, AI can facilitate the process of testing and verifying changes and, thus, improving the code’s quality in large-scale computer programs like Chrome. In this way, AI can meaningfully contribute to ensuring safer and more stable computer software, which is critical for all users of such systems.