Chrome's Multi-Agent Bug Fixing Pipeline Just Fixed More Bugs Than the Last 23 Releases Combined

In Chrome 149 and 150, Google's security team fixed 1,072 security bugs, more than every bug fixed across the prior 23 milestones combined. That number comes from Google's own security blog, published July 30, 2026, and it is not a typo or a rounding trick. It is what happens when a multi-agent bug fixing pipeline replaces a single tool doing everything, and each stage of the pipeline is designed to catch what the previous stage missed.

The headline risk with a claim like this is that it collapses into "Google used AI and got a big number." The more useful version, and the one worth taking apart, is the architecture underneath it: which agent does what, where a human still has to look, and why splitting the work into stages produced a result that a single do-everything agent almost certainly would not have.

The pipeline has four separate jobs, not one

Google's post describes the system as a sequence of specialized agents rather than one model asked to "find and fix bugs." The finding stage runs on Big Sleep, an AI vulnerability discovery agent built with DeepMind and Project Zero, which searches the Chrome codebase, including the V8 JavaScript engine and the graphics stack, for exploitable patterns a human reviewer would need days to spot by hand. Big Sleep's lineage traces back to Naptime, a 2024 Project Zero project that first gave a language model specialized tools for vulnerability research instead of asking it to reason about security in the abstract.

Once a candidate bug is found, the job hands off to a second tool, CodeMender, which runs inside Chrome's CI system every 24 hours across all code changes. CodeMender's fixing agent proposes multiple candidate patches rather than a single fix. A separate critic agent then evaluates those candidates, and the two loop against each other in a cycle built to mimic human code review, checking for both functional correctness and style compliance before anything reaches a developer. Only after that loop settles do test-writing agents generate coverage across every platform Chrome supports, so a fix that works on one configuration does not silently break another.

That is four distinct roles: find, fix, critique, test. None of them is asked to do another's job, and the critic agent's entire function is to catch what the fixing agent gets wrong before a person has to.

The number behind the number

The 13-year-old bug is the clearest illustration of what this pipeline is actually for. Tracked as crbug.com/487383169, it was a sandbox escape that let a compromised renderer trick the browser into reading local files, and it had sat undetected in the codebase for more than 13 years. That is not a bug a fuzzer stumbles into by luck. It is the kind of finding that requires an agent capable of reasoning across a large, old, heavily modified codebase the way Big Sleep is built to.

Google reports that in May 2026 alone, the pipeline blocked more than 20 vulnerabilities from reaching production, including one critical S1+ severity issue, its highest internal severity tier. The company is also candid about what it cannot cleanly measure: it states plainly that it is "hard to measure precisely" how many developer hours the automated triage saves, while still offering an estimate of hundreds of hours per month. That caveat matters more than it looks like it should. A company willing to publish a headline number and then flag which part of the story it cannot fully verify is a company worth taking more seriously on the parts it does verify.

Why more bugs found is not a sign of decline

Google's own framing of the 1,072 figure is worth carrying forward directly: a spike in bugs found and fixed is not evidence that Chrome got less secure. It is what happens when the tool for finding bugs gets radically better than what came before it. The real contest, as Google frames it, is not whether bugs exist, they always do in a codebase this size, but whether the fix ships faster than an attacker can reverse-engineer it from the public patch once it lands. Early 2026 already tested that framing: bug reports climbed across every category, and by March, Google had received more of them than in the whole of 2025. Rather than treat that as an anomaly, the team adjusted its Vulnerability Reward Program to prioritize submissions that were additive to what the internal pipeline was already finding, rather than duplicative of it.

The reusable pattern for anyone building agent systems

For anyone assembling their own agent pipeline, the transferable lesson is not "add AI to code review." It is the separation of roles: a finder that only finds, a fixer that only proposes fixes, a critic whose sole job is disagreeing with the fixer until the output holds up, and a tester that verifies across every environment before a human signs off. A single agent asked to find a bug, fix it, judge its own fix, and confirm it works has no structural pressure to catch its own mistakes. A critic agent that exists specifically to push back does. That distinction shows up everywhere agent reliability breaks down in practice, not just in security tooling, and it is the same reason a long list of standing instructions handed to one agent tends to degrade under its own weight rather than get followed more carefully.

Chrome's pipeline works because each stage has one job and a different agent whose job is to check it. That is a small architectural choice with a 1,072-bug result behind it.

Source: Stronger with every update: How we're making Chrome and the web safer in the AI Era, Google, July 30, 2026.