Google Pushes Automated AI Vulnerability Patching as Core Cyber Defense

Google’s Chrome security program has increasingly paired traditional code review and fuzzing with in-house artificial intelligence and large language models to uncover flaws that may have remained buried for years. The shift matters because Chrome is a gateway to online banking, commerce and corporate systems for billions of users, making faster vulnerability discovery and remediation a broad cybersecurity issue. Google said AI has materially changed the speed and scale of both detection and defense.

Google said on July 30 that Chrome 149 and Chrome 150, released to the stable channel on June 2 and June 30, 2026, respectively, fixed a combined 1,072 security bugs. That exceeded the 1,036 vulnerabilities repaired across the previous 23 Chrome milestones, compressing roughly two years of fixes into one month. The AI-assisted effort also uncovered a Chrome flaw that had remained undetected for 13 years, highlighting the technology’s growing role in finding long-lived weaknesses.

Software supply-chain attacks and flaws in open-source components have left engineering teams sorting through large volumes of security alerts, many of which never become practical exploits. Google’s CodeMender is designed to compress that workflow by using an AI agent to validate vulnerabilities, generate fixes and test patches. The approach could help developers focus scarce security resources on defects that pose an immediate, demonstrable threat.

As of July 24, 2026, Google has released CodeMender in public preview. The agent runs checks in an isolated environment, confirms whether a flaw can be exploited, and then creates and tests a patch before proposing it to developers. CodeMender uses Gemini 3.5 Flash as its default model, positioning the tool as a way for teams to prioritize verified risks and shorten the time between vulnerability discovery and remediation.

Generative AI is reshaping both cyberattacks and defenses. Attackers can use it to automate malware development, gather intelligence and scale operations, while defenders can accelerate vulnerability analysis and threat tracking. Shane Huntley, chief technology officer at Google's Threat Intelligence Group, said the shift marked an important turning point for companies to redesign their cybersecurity strategies. The developments did not involve any transaction value.

The latest developments show that AI is increasing both the speed of attacks and the capabilities of defenders. Google warned that hackers could launch operations faster and at greater scale, while Anthropic's Claude Mythos model showed potential to uncover previously unknown vulnerabilities. The available information gave no specific release date, number of vulnerabilities or monetary figures. The current focus remains on validating model performance and building safeguards.