标签：#vulnerabilitymanagement

TL;DR: Google’s Gemini AI agents identified and helped remediate 1,072 Chrome security flaws in 60 days, dramatically shrinking the window for attackers. The race to protect 3.5 billion Chrome users has taken a high‑tech shortcut. Instead of relying solely on human researchers, Google deployed its Gemini‑powered AI agents to hunt for bugs, triage findings, and even suggest patches. The result? Over a thousand vulnerabilities squashed in just two months—a pace that would have taken years using traditional methods. How Gemini’s AI Agents Accelerated Chrome’s Bug Hunt Google’s internal security team integrated Gemini, the company’s latest large‑language‑model platform, into its vulnerability‑scanning pipeline. The AI agents performed three core tasks: Automated code analysis – By ingesting Chrome’s massive codebase, the models flagged risky patterns, unsafe API calls, and legacy modules that often hide bugs. Prioritization and risk scoring – Gemini assigned a severity score to each finding, allowing engineers to focus on exploits with the highest potential impact. Patch drafting assistance – For many low‑complexity issues, the AI generated candidate code changes, which senior engineers then reviewed and merged. The system worked in a loop: the AI scanned, reported, received feedback, and refined its heuristics. This iterative approach cut the average time‑to‑detect from weeks to hours and reduced manual triage effort by an estimated 40 %. The Scale and Impact of Fixing 1,072 Vulnerabilities During the 60‑day sprint, the AI‑augmented process uncovered 1,072 distinct security bugs across Chrome’s rendering engine, JavaScript runtime, and networking stack. Roughly half were classified as “high‑severity,” meaning they could have enabled remote code execution or data exfiltration. Key outcomes include: Reduced exposure window – The median time between bug discovery and patch release dropped from 45 days (historical average) to under 7 days. Broad coverage – The AI identifie