Google used Gemini AI agents to identify and patch 1,072 security vulnerabilities in Chrome versions 149 and 150 [1].
This shift toward automated remediation significantly accelerates the speed at which the company can protect its user base. By reducing the time between vulnerability discovery and the deployment of a fix, Google aims to minimize the window of opportunity for attackers to exploit software flaws.
The AI-driven pipeline resolved the vulnerabilities within a 60-day period [3]. This effort protected approximately 3.5 billion active Chrome users [4]. Among the discoveries, a Gemini agent identified a sandbox escape bug that had existed in the code for 13 years [6].
"More than 1,000 security bugs were patched across the browser's two most recent releases thanks to our AI pipeline," a Google security lead said [7].
Beyond bug discovery, Google is testing a dynamic-patching system to eliminate the need for users to restart their browsers to apply updates. The company is currently testing these security updates on a twice-weekly basis [5]. This system leverages the browser's multi-process architecture to update specific components without interrupting the user experience.
"By leveraging Chrome's multi‑process architecture, dynamic patching sequentially replaces background child processes (like the Renderer and GPU) with updated binaries on the fly," a Google spokesperson said [0].
The integration of Gemini agents allows the security team to triage and fix flaws continuously in the background. This automation targets the high volume of vulnerabilities that typically emerge in complex browser environments, reducing the manual burden on human engineers.
“More than 1,000 security bugs were patched across the browser's two most recent releases thanks to our AI pipeline.”
The deployment of AI agents for vulnerability management marks a transition from reactive to proactive security. By automating the discovery of long-standing bugs—such as the 13-year-old sandbox escape—and implementing dynamic patching, Google is attempting to remove the 'human bottleneck' in software maintenance. If successful, the ability to patch software without browser restarts could increase the adoption rate of security updates across the global user base.
