Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI 谷歌表示，得益于AI工具，6月修复的Chrome漏洞数量超过过去两年的总和

TL;DR

• Google patched 1,072 security bugs in two Chrome releases (versions 149 and 150) within one month, surpassing the total of 1,036 bugs fixed across the previous 23 versions over two years.
• This surge is attributed to internal AI tools—specifically Gemini—used to automate vulnerability detection and remediation at scale.
• The exponential increase in bug discovery reflects a broader industry trend where AI-driven security operations are becoming essential for proactive defense against sophisticated threats.
• Microsoft also reported a record 570 fixes via AI-assisted processes, while Apple showed no comparable spike, suggesting uneven adoption or reliance on traditional methods.

Why It Matters

This case demonstrates how generative AI can dramatically accelerate software security workflows, shifting vulnerability management from reactive to preemptive. For practitioners and enterprises, it underscores the strategic imperative to integrate AI into DevSecOps pipelines—not just as an aid but as a core component of modern cybersecurity infrastructure. The data validates earlier warnings that attackers will increasingly leverage AI, making defensive AI adoption non-negotiable for maintaining trust and compliance.

Technical Details

• Google deployed its proprietary large language model Gemini internally to scan codebases, identify potential vulnerabilities, and generate patches automatically across Chrome’s complex codebase.
• The analysis covered two consecutive milestone releases (Chrome 149 and 150), both issued in June 2024, with each version undergoing automated scanning before public release.
• Vulnerability types likely included memory safety issues, race conditions, and logic flaws common in browser engines—areas where pattern recognition and contextual understanding excel.
• Metrics were tracked per “milestone” (i.e., major version), enabling direct comparison between pre-AI and post-AI eras; the jump from ~45 bugs/average version to over 500 per recent version indicates a >10x efficiency gain.
• Implementation involved integrating AI models into existing CI/CD pipelines, allowing real-time feedback during development without disrupting release cadence.

Industry Insight

Organizations should prioritize embedding LLM-based static/dynamic analysis tools into their SDLC to match Google’s level of proactive threat mitigation. Expect regulatory bodies and standards bodies (e.g., NIST, ISO) to soon recommend or mandate AI-augmented security testing for critical software platforms. Companies lagging in AI integration risk falling behind not only in speed of patching but also in resilience against zero-day exploits that may go undetected under manual review regimes.

TL;DR

• Google利用内部AI工具在一个月内修复的Chrome安全漏洞数量（1,072个）超过了过去两年总和（1,036个），验证了AI在自动化漏洞发现中的指数级效能。
• LLMs将网络安全转变为“自动化、工业级操作”，显著提升了漏洞预检与修复效率，使防御方能主动超越攻击者。
• 微软同样通过AI实现单月570个漏洞修复的记录，而Apple未呈现类似增长趋势，表明AI驱动的安全策略在不同厂商间存在差异化应用。

为什么值得看

该案例揭示了AI如何从根本上重塑软件安全开发流程，为行业提供可量化的技术转型范本。对AI从业者而言，它展示了大模型在工程实践中的规模化落地路径；对企业决策者则提示：若不引入AI辅助安全检测，可能在漏洞响应速度上被竞争对手甩开。

技术解析

• Google采用Gemini等LLM作为核心分析引擎，结合其内部AI工具链实现漏洞的自动识别与分类，覆盖Chrome浏览器多个里程碑版本（如149、150）。
• 数据对比显示：仅两个新版本（June 2024发布）即完成1,072次修复，远超此前23个版本累计1,036次，体现AI带来的效率跃迁。
• 微软同期报告570个跨产品线漏洞修复，归因于其自研AI系统支持下的自动化扫描与补丁生成机制。
• Apple未观察到类似爆发式增长，2026年已修复482个漏洞，接近历史水平，暗示其当前安全流程尚未深度整合AI驱动的分析能力。
• 所有数据均基于公开版本发布记录及第三方统计，具备可验证性与横向比较价值。

行业启示

• AI将成为未来软件安全基础设施的标准组件，企业需评估自身是否具备将大模型集成至CI/CD管道以加速漏洞响应的能力。
• 安全团队的职能将从“被动修补”转向“预测性防御”，掌握AI工具使用技能成为工程师必备素质。
• 不同厂商在AI adoption上的差异可能拉开产品安全性差距，建议优先布局具备上下文理解与代码生成能力的专用安全大模型。