Chrome needs twice-a-week patching thanks to AI bug hunting

Google's Chrome browser has accelerated its security patching cadence due to a surge in vulnerability discoveries enabled by AI tools. In June, Chrome's two major releases included fixes for 1,072 security bugs, exceeding the total from the prior 23 major releases combined. The Chrome security team has been using machine learning since 2012, but 2024 marks an inflection point with new AI models integrated into vulnerability discovery and patch development. Chrome is now piloting security fixes twice a week, though this pace may not persist indefinitely. The team is also focusing on structural changes, such as rewriting code in the memory-safe language Rust, to eliminate entire categories of bugs. They anticipate a new equilibrium as AI models gain encyclopedic knowledge of past vulnerabilities and code evolution.