Google Pilots Twice-Weekly Chrome Patches Amid AI Bug Surge

Something curious is happening at the top of the Chrome release pipeline, and it is worth pausing on because it is one of the earliest real-world signals of what happens when AI shifts from finding software bugs occasionally to finding them constantly. According to Wired, Google is piloting two Chrome security releases per week, on top of a shift that is already moving major-milestone cadence to every two weeks. The trigger is volume. Chrome 149 and 150 together patched 1,072 security bugs, more than all of the prior 23 milestones combined.

The reason for the surge is on Google's own side of the wall. Its internal AI tooling, notably BigSleep and CodeMender, developed with DeepMind and Project Zero, runs against every code change roughly every 24 hours. Google says that in May alone this stack blocked more than 20 vulnerabilities from ever reaching production, including one rated critical. Internal AI-driven discoveries have been outpacing external bug-bounty submissions for months, and since April the company has shipped fixes for more than 1,400 Chrome vulnerabilities.

The strategic wrinkle is the patch gap. Chrome is open source, so the moment a fix lands publicly, attackers can reverse it and race to exploit the same bug before the patch reaches billions of user machines, the classic N-day play. If defenders can now find flaws faster, they need to ship faster too, and the twice-a-week pilot is essentially Google conceding that its old cadence is no longer fast enough for the pace of its own discoveries. The uncomfortable corollary, which the reporting acknowledges directly, is that the same class of AI tooling is presumably becoming available to attackers as well.

The honest caveat is that we do not know how many of those 1,072 bugs would have been considered serious under the old triage bar versus routine issues that AI simply surfaces cheaply, so some of the raw number is almost certainly inflation. And a faster cadence is only a win if enterprises and downstream Chromium redistributors can actually keep up with it. A patch that ships twice a week but takes corporate IT a month to roll out just widens the exposure window for everyone else.

What is worth watching from here is whether the rest of the browser ecosystem, and every other large codebase Google runs the same tooling against, is quietly heading for the same treatment.